Thore Cimbal
db77785b6b
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Deploys ClamAV and a small stdlib-only Synapse spam-checker module implementing check_media_file_for_spam over clamd's INSTREAM protocol. Unlike the originally-considered matrix-content-scanner proxy (which needs client-side cooperation neither Element Web nor Element X provide), this hooks Synapse's own module API directly - transparent to every client for unencrypted media. No custom Synapse image needed: the module is mounted via a ConfigMap onto PYTHONPATH using the ESS chart's extraVolumes/extraVolumeMounts/extraEnv support. Fails open on scanner errors so a ClamAV outage can't block all uploads.
86 lines
2.6 KiB
YAML
86 lines
2.6 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: ess-synapse-custom
|
|
namespace: matrix
|
|
data:
|
|
values.yaml: |
|
|
synapse:
|
|
logging:
|
|
rootLevel: INFO
|
|
levelOverrides:
|
|
synapse.media.url_previewer: DEBUG
|
|
# ClamAV media scanning module (Issue #19) - mounted read-only from a ConfigMap
|
|
# (synapse-clamav-module) since the container runs with a read-only root filesystem
|
|
# and we avoid a custom Synapse image; PYTHONPATH picks it up for the `modules:`
|
|
# block below.
|
|
extraVolumes:
|
|
- name: clamav-spam-checker
|
|
configMap:
|
|
name: synapse-clamav-module
|
|
extraVolumeMounts:
|
|
- name: clamav-spam-checker
|
|
mountPath: /extra-modules/clamav_spam_checker.py
|
|
subPath: clamav_spam_checker.py
|
|
readOnly: true
|
|
extraEnv:
|
|
- name: PYTHONPATH
|
|
value: /extra-modules
|
|
additional:
|
|
url-previews:
|
|
config: |
|
|
url_preview_enabled: true
|
|
url_preview_ip_range_blacklist:
|
|
- '127.0.0.0/8'
|
|
- '10.0.0.0/8'
|
|
- '172.16.0.0/12'
|
|
- '192.168.0.0/16'
|
|
- '::1/128'
|
|
- 'fe80::/10'
|
|
- 'fc00::/7'
|
|
max_spider_size: 10M
|
|
retention:
|
|
config: |
|
|
retention:
|
|
enabled: true
|
|
default_policy:
|
|
min_lifetime: 1d
|
|
max_lifetime: 1y
|
|
allowed_lifetime_min: 1d
|
|
allowed_lifetime_max: 2y
|
|
purge_jobs:
|
|
- longest_max_lifetime: 3d
|
|
interval: 12h
|
|
- shortest_max_lifetime: 3d
|
|
longest_max_lifetime: 1w
|
|
interval: 1d
|
|
- shortest_max_lifetime: 1w
|
|
interval: 2d
|
|
|
|
media_retention:
|
|
local_media_lifetime: 365d
|
|
remote_media_lifetime: 90d
|
|
|
|
redaction_retention_period: 7d
|
|
forgotten_room_retention_period: 28d
|
|
user_ips_max_age: 90d
|
|
auto_join:
|
|
config: |
|
|
auto_join_rooms:
|
|
- "#onboarding:axion1337.chat"
|
|
auto_join_rooms_for_guests: false
|
|
room_publish:
|
|
config: |
|
|
room_list_publication_rules:
|
|
- user_id: "*"
|
|
action: allow
|
|
oembed:
|
|
config: |
|
|
oembed_enabled: true
|
|
clamav-module:
|
|
config: |
|
|
modules:
|
|
- module: clamav_spam_checker.ClamAVSpamChecker
|
|
config:
|
|
clamd_host: "clamav.matrix.svc.cluster.local"
|
|
clamd_port: 3310 |