Thore Cimbal
9db1ee6f45
Deploys ClamAV and a small stdlib-only Synapse spam-checker module implementing check_media_file_for_spam over clamd's INSTREAM protocol. Unlike the originally-considered matrix-content-scanner proxy (which needs client-side cooperation neither Element Web nor Element X provide), this hooks Synapse's own module API directly - transparent to every client for unencrypted media. No custom Synapse image needed: the module is mounted via a ConfigMap onto PYTHONPATH using the ESS chart's extraVolumes/extraVolumeMounts/extraEnv support. Fails open on scanner errors so a ClamAV outage can't block all uploads.
67 lines
1.6 KiB
YAML
67 lines
1.6 KiB
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: clamav
|
|
namespace: matrix
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: clamav
|
|
ports:
|
|
- name: clamd
|
|
port: 3310
|
|
protocol: TCP
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: clamav
|
|
namespace: matrix
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: clamav
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: clamav
|
|
spec:
|
|
containers:
|
|
- name: clamav
|
|
image: clamav/clamav:1.5.3
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- name: clamd
|
|
containerPort: 3310
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/clamav
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 1.5Gi
|
|
limits:
|
|
memory: 3Gi
|
|
# clamd needs the full signature DB downloaded (freshclam, can take several
|
|
# minutes on first start) before it accepts connections - the image's own
|
|
# healthcheck script accounts for this via a long StartPeriod.
|
|
livenessProbe:
|
|
exec:
|
|
command: ["clamdcheck.sh"]
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
failureThreshold: 10
|
|
readinessProbe:
|
|
exec:
|
|
command: ["clamdcheck.sh"]
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 15
|
|
failureThreshold: 20
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: clamav-data
|