build(infra): run ClamAV in compose and on the cluster (closes #191) #193

2026-10-02T07:03:11Z

not commented

2026-10-02 07:03:11 +00:00

Runs a ClamAV daemon next to the stack, so the domain can scan uploaded diplomas in #192. Records the decision in ADR-0036 (#190).

clamav service (official clamav/clamav:1.4.6) in compose and the Helm chart. Signatures live on a volume, ConcurrentDatabaseReload no keeps a reload from doubling memory, compose caps it at 2g and the chart requests 1200Mi. It is in WAIT_SVCS.
make verify-clamav / CI verify-stack step: over INSTREAM, EICAR comes back FOUND and a clean stream OK.
ADR-0036 and a runbook row for slow or throttled signature downloads.

Dependency justification (§13): clamd gives us a maintained signature engine with daily updates. Replacing it would mean a commercial scanning API, or nothing. Risks: about 1 GB more RAM on the verify runner (#182), and the first start needs outbound internet to the ClamAV CDN, which rate-limits by IP.

Verified locally: docker compose up clamav was healthy in 12s (about 950 MiB), verify-clamav passed, k8s-lint and k8s-drift are green. Not run: the full verify-stack, which runs only on main (#184), and mkdocs build --strict, since mkdocs isn't installed locally.

closes #191

🤖 Generated with Claude Code

Runs a ClamAV daemon next to the stack, so the domain can scan uploaded diplomas in #192. Records the decision in ADR-0036 (#190). - `clamav` service (official `clamav/clamav:1.4.6`) in compose and the Helm chart. Signatures live on a volume, `ConcurrentDatabaseReload no` keeps a reload from doubling memory, compose caps it at 2g and the chart requests 1200Mi. It is in `WAIT_SVCS`. - `make verify-clamav` / CI verify-stack step: over INSTREAM, EICAR comes back `FOUND` and a clean stream `OK`. - ADR-0036 and a runbook row for slow or throttled signature downloads. **Dependency justification (§13):** clamd gives us a maintained signature engine with daily updates. Replacing it would mean a commercial scanning API, or nothing. Risks: about 1 GB more RAM on the verify runner (#182), and the first start needs outbound internet to the ClamAV CDN, which rate-limits by IP. **Verified locally:** `docker compose up clamav` was healthy in 12s (about 950 MiB), `verify-clamav` passed, `k8s-lint` and `k8s-drift` are green. Not run: the full verify-stack, which runs only on main (#184), and `mkdocs build --strict`, since mkdocs isn't installed locally. closes #191 🤖 Generated with [Claude Code](https://claude.com/claude-code)

not added this to the Iteration 6 — Production Posture milestone 2026-10-02 07:03:11 +00:00

not added 3 commits 2026-10-02 07:03:11 +00:00

test(infra): clamd detects EICAR and passes a clean stream over INSTREAM (refs #191 ) 3e9bda9031

Red: no clamav service exists yet, so verify-clamav finds no container.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

build(infra): run clamd in compose and the Helm chart (refs #191 ) 39bc6ee0c5

Official clamav/clamav:1.4.6 with signatures on a volume, ConcurrentDatabaseReload
off to cap memory, health-gated in WAIT_SVCS. verify-clamav is green: EICAR is
FOUND, a clean stream is OK.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs(arch): ADR-0036 — scan uploads with ClamAV in the domain, fail closed (refs #191 , refs #190 )

CI / k8s (pull_request) Successful in 8s

Details

CI / build (pull_request) Successful in 1m42s

Details

CI / lint (pull_request) Successful in 1m56s

Details

CI / docs (pull_request) Successful in 53s

Details

CI / unit (pull_request) Successful in 1m21s

Details

CI / frontend (pull_request) Successful in 2m22s

Details

CI / mutation (pull_request) Successful in 4m47s

Details

CI / verify-stack (pull_request) Skipped

Details

f541254de7

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

not added the type:slice area:infra labels 2026-10-02 07:03:19 +00:00

not added 1 commit 2026-10-02 07:23:54 +00:00

build(infra): run clamd in the local compose stack too (refs #191 )

CI / k8s (pull_request) Successful in 8s

Details

CI / build (pull_request) Successful in 1m41s

Details

CI / lint (pull_request) Successful in 1m53s

Details

CI / docs (pull_request) Successful in 55s

Details

CI / unit (pull_request) Successful in 1m22s

Details

CI / frontend (pull_request) Successful in 2m31s

Details

CI / verify-stack (pull_request) Canceled after 0s

Details

CI / mutation (pull_request) Canceled after 8m0s

Details

d698267fba

make local waits on the same WAIT_SVCS, so without it the local stack never
turns healthy.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

not added 1 commit 2026-10-02 07:30:00 +00:00

docs(arch): ADR-0036 — check %PDF- after the scan, not before (refs #191 , refs #190 )

CI / lint (pull_request) Successful in 2m0s

Details

CI / k8s (pull_request) Successful in 10s

Details

CI / build (pull_request) Successful in 1m14s

Details

CI / unit (pull_request) Successful in 1m18s

Details

CI / docs (pull_request) Successful in 43s

Details

CI / frontend (pull_request) Successful in 2m22s

Details

CI / mutation (pull_request) Successful in 4m57s

Details

CI / verify-stack (pull_request) Skipped

Details

f93b4a4426

clamd matches EICAR only at the start of a file, so a type check in front of
the scan would report malware as merely not-a-PDF.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

not referenced this pull request

2026-10-02 07:30:31 +00:00

feat(domain): virus-scan and PDF-check uploaded diplomas with ClamAV (closes #192) #194

not merged commit 5fdcbd27c0 into main

2026-10-02 07:53:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eho/register-referentie#193