varias alteracoes

deploy/docker/clamd.conf

@@ -0,0 +1,23 @@
+# Container-only endpoint: this container is attached only to malware-private.
+# Do not add a Docker ports mapping for TCP/3310.
+DatabaseDirectory /var/lib/clamav
+LocalSocket /run/clamav/clamd.ctl
+LocalSocketMode 660
+TCPSocket 3310
+TCPAddr 0.0.0.0
+Foreground yes
+User clamav
+MaxThreads 2
+MaxQueue 16
+CommandReadTimeout 5
+ReadTimeout 120
+SendBufTimeout 30
+MaxScanTime 120000
+MaxFileSize 25M
+MaxScanSize 100M
+MaxRecursion 10
+MaxFiles 1000
+StreamMaxLength 25M
+AlertEncrypted yes
+AlertExceedsMax yes
+LogTime yes

deploy/docker/compose.yaml

@@ -23,12 +23,22 @@ services:
       DB_URL: ''
       CACHE_STORE: database
       QUEUE_CONNECTION: database
+      DB_QUEUE_RETRY_AFTER: '210'
       SESSION_DRIVER: database
       SESSION_SECURE_COOKIE: 'false'
       MAIL_MAILER: array
       PORTAL_NOTIFICATIONS_ENABLED: 'false'
       LOG_CHANNEL: stderr
       FILESYSTEM_DISK: local
+      MALWARE_SCANNER: clamd
+      CLAMD_HOST: clamav
+      CLAMD_PORT: '3310'
+      CLAMD_TIMEOUT_SECONDS: '120'
+      CLAMD_MAX_SIGNATURE_AGE_HOURS: '48'
+      CLAMD_MAX_FILE_BYTES: '20971520'
+      CLAMD_MAX_STREAM_BYTES: '26214400'
+      CLAMD_MAX_DECOMPRESSED_BYTES: '104857600'
+      CLAMD_MAX_ARCHIVE_ENTRIES: '1000'
     volumes:
       - ../..:/var/www/html
       - ./runtime.env.example:/var/www/html/.env:ro
@@ -37,6 +47,9 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
+    networks:
+      - default
+      - malware-private
     healthcheck:
       test: ['CMD', 'curl', '--fail', 'http://127.0.0.1/up']
       interval: 15s
@@ -55,7 +68,7 @@ services:
     image: investmoz-development-php85
     environment:
       <<: *application
-      SUPERVISOR_PHP_COMMAND: '/usr/bin/php /var/www/html/artisan queue:work --sleep=3 --tries=3 --timeout=90'
+      SUPERVISOR_PHP_COMMAND: '/usr/bin/php /var/www/html/artisan queue:work --sleep=3 --tries=3 --timeout=150'
     volumes:
       - ../..:/var/www/html
       - ./runtime.env.example:/var/www/html/.env:ro
@@ -64,6 +77,9 @@ services:
     depends_on:
       app:
         condition: service_healthy
+    networks:
+      - default
+      - malware-private
   postgres:
     image: postgis/postgis:17-3.5
     environment:
@@ -77,7 +93,36 @@ services:
       interval: 5s
       timeout: 5s
       retries: 10
+    networks:
+      - default
+  clamav:
+    image: clamav/clamav:1.5.4
+    environment:
+      CLAMAV_NO_MILTERD: 'true'
+      CLAMD_STARTUP_TIMEOUT: '1800'
+      FRESHCLAM_CHECKS: '12'
+    volumes:
+      - clamav-database:/var/lib/clamav
+      - ./clamd.conf:/etc/clamav/clamd.conf:ro
+    mem_limit: 4g
+    cpus: 2.0
+    logging:
+      options:
+        max-size: '10m'
+        max-file: '3'
+    healthcheck:
+      test: ['CMD', 'clamdscan', '--ping=3']
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30m
+    networks:
+      - malware-private
+networks:
+  malware-private:
+    driver: bridge
 volumes:
   database:
   application-storage:
   application-cache:
+  clamav-database:

deploy/docker/runtime.env.example

@@ -4,5 +4,15 @@ APP_ENV=local
 APP_DEBUG=false
 LOG_CHANNEL=stderr
 MAIL_MAILER=array
+DB_QUEUE_RETRY_AFTER=210
+MALWARE_SCANNER=clamd
+CLAMD_HOST=clamav
+CLAMD_PORT=3310
+CLAMD_TIMEOUT_SECONDS=120
+CLAMD_MAX_SIGNATURE_AGE_HOURS=48
+CLAMD_MAX_FILE_BYTES=20971520
+CLAMD_MAX_STREAM_BYTES=26214400
+CLAMD_MAX_DECOMPRESSED_BYTES=104857600
+CLAMD_MAX_ARCHIVE_ENTRIES=1000
 PORTAL_NOTIFICATIONS_ENABLED=false
 INVESTMOZ_AI_ENABLED=false