commit f7681301f43cb1ef64fb1d5c860aa8761db88561
parent 2b83b27dc3ce70da76b41f80c2dde5eb210c7d48
Author: MTRNord <mtrnord1@gmail.com>
Date: Tue, 15 Apr 2025 20:09:43 +0200
clamav and some rspamd tweaking
Diffstat:
6 files changed, 110 insertions(+), 36 deletions(-)
diff --git a/apps/base/matrix/synapse/kustomization.yaml b/apps/base/matrix/synapse/kustomization.yaml
@@ -10,9 +10,13 @@ configMapGenerator:
- name: rspamd-config
namespace: matrix
files:
- - greylist.conf=rspamd-config/local.d/greylist.conf
+ - actions.conf=rspamd-config/local.d/actions.conf
+ - antivirus.conf=rspamd-config/local.d/antivirus.conf
- classifier-bayes.conf=rspamd-config/local.d/classifier-bayes.conf
+ - dmarc.conf=rspamd-config/local.d/dmarc.conf
+ - greylist.conf=rspamd-config/local.d/greylist.conf
+ - hfilter.conf=rspamd-config/local.d/hfilter.conf
+ - history_redis.conf=rspamd-config/local.d/history_redis.conf
+ - logging.inf=rspamd-config/local.d/logging.inf
- options.inc=rspamd-config/local.d/options.inc
- worker-controller.inc=rspamd-config/local.d/worker-controller.inc
- - history_redis.conf=rspamd-config/local.d/history_redis.conf
- - dmarc.conf=rspamd-config/local.d/dmarc.conf
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/actions.conf b/apps/base/matrix/synapse/rspamd-config/local.d/actions.conf
@@ -0,0 +1,16 @@
+# documentation: https://rspamd.com/doc/configuration/metrics.html#actions
+# and https://rspamd.com/doc/configuration/metrics.html
+
+# These values work in conjunction with the symbol scores in
+# `scores.d/*.conf`. When adjusting them, make sure to understand
+# and to be able to explain the impact on the whole system.
+greylist = 4;
+add_header = 6;
+reject = 11;
+
+# The value `null` disabled the action. A subject rewrite is handled by `SPAM_SUBJECT`:
+# https://docker-mailserver.github.io/docker-mailserver/latest/config/environment/#spam_subject
+#
+# The reasoning for this can be found in
+# https://github.com/docker-mailserver/docker-mailserver/issues/3804
+rewrite_subject = null;
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/antivirus.conf b/apps/base/matrix/synapse/rspamd-config/local.d/antivirus.conf
@@ -0,0 +1,20 @@
+# documentation: https://rspamd.com/doc/modules/antivirus.html
+
+enabled = true;
+
+clamav {
+ type = "clamav";
+ servers = "localhost:3310";
+ action = "reject";
+ message = '${SCANNER} FOUND VIRUS "${VIRUS}"';
+ scan_mime_parts = false;
+ symbol = "CLAM_VIRUS";
+ log_clean = true;
+ max_size = 25000000;
+ timeout = 10;
+ retransmits = 2;
+ patterns {
+ # symbol_name = "pattern";
+ JUST_EICAR = '^Eicar-Test-Signature$';
+ }
+}
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/hfilter.conf b/apps/base/matrix/synapse/rspamd-config/local.d/hfilter.conf
@@ -0,0 +1,6 @@
+helo_enabled = false; # helo patterns (e.g. unresolved domains, bare ip addresses etc)
+hostname_enabled = false; # hostname patterns
+url_enabled = true; # url rules (e.g. `HFILTER_URL_ONLY` or `HFILTER_URL_ONELINE`)
+from_enabled = true; # mail from rules
+rcpt_enabled = true; # recipient rules
+mid_enabled = false; # message id rules (e.g. `HFILTER_MID_NORESOLVE_MX` or `HFILTER_MID_NOT_FQDN`)
diff --git a/apps/base/matrix/synapse/rspamd-config/local.d/logging.inc b/apps/base/matrix/synapse/rspamd-config/local.d/logging.inc
@@ -0,0 +1,4 @@
+type = "console";
+level = "silent";
+color = false;
+systemd = false;
diff --git a/apps/base/matrix/synapse/rspamd.yaml b/apps/base/matrix/synapse/rspamd.yaml
@@ -31,45 +31,69 @@ spec:
fsGroup: 11333
runAsUser: 11333
containers:
+ - name: rspamd-clamav
+ image: clamav/clamav:1.4
+ resources:
+ requests:
+ memory: "3000Mi"
+ cpu: "500m"
+ limits:
+ memory: "4000Mi"
+ cpu: "500m"
+ ports:
+ - containerPort: 3310
+ name: clamav
- name: rspamd-matrix
image: ghcr.io/rspamd/rspamd-docker:latest
resources:
- limits:
- memory: "1000Mi"
- cpu: "500m"
+ limits:
+ memory: "1000Mi"
+ cpu: "500m"
ports:
- - containerPort: 11333
- name: normal-worker
- - containerPort: 11334
- name: control-worker
+ - containerPort: 11333
+ name: normal-worker
+ - containerPort: 11334
+ name: control-worker
volumeMounts:
- - name: rspamd-matrix
- mountPath: /var/lib/rspamd
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/greylist.conf
- subPath: greylist.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/classifier-bayes.conf
- subPath: classifier-bayes.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/options.inc
- subPath: options.inc
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/worker-controller.inc
- subPath: worker-controller.inc
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/history_redis.conf
- subPath: history_redis.conf
- - name: rspamd-config
- mountPath: /etc/rspamd/local.d/dmarc.conf
- subPath: dmarc.conf
+ - name: rspamd-matrix
+ mountPath: /var/lib/rspamd
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/actions.conf
+ subPath: actions.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/antivirus.conf
+ subPath: antivirus.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/classifier-bayes.conf
+ subPath: classifier-bayes.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/dmarc.conf
+ subPath: dmarc.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/greylist.conf
+ subPath: greylist.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/hfilter.conf
+ subPath: hfilter.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/history_redis.conf
+ subPath: history_redis.conf
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/logging.inc
+ subPath: logging.inc
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/options.inc
+ subPath: options.inc
+ - name: rspamd-config
+ mountPath: /etc/rspamd/local.d/worker-controller.inc
+ subPath: worker-controller.inc
volumes:
- name: rspamd-matrix
persistentVolumeClaim:
- claimName: rspamd-matrix
+ claimName: rspamd-matrix
- name: rspamd-config
configMap:
- name: rspamd-config
+ name: rspamd-config
---
apiVersion: v1
kind: Service
@@ -101,8 +125,8 @@ spec:
- rspamd.matrix.midnightthoughts.space
rules:
- backendRefs:
- - name: rspamd-matrix
- port: 11334
+ - name: rspamd-matrix
+ port: 11334
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
