Внедрение KESL на ВМ2 + замена CLAMAV на KESL

VM2_services/codebase/services/docker-compose.yml

@@ -22,8 +22,7 @@ x-message-safety-environment: &message-safety-environment
   MESSAGE_SAFETY_PORT: ${MESSAGE_SAFETY_PORT:-8080}
   MESSAGE_SAFETY_WORKER_CONCURRENCY: ${MESSAGE_SAFETY_WORKER_CONCURRENCY:-5}
   MESSAGE_SAFETY_DNS_RESOLVERS: ${MESSAGE_SAFETY_DNS_RESOLVERS:?set trusted DNS resolvers}
-  MESSAGE_SAFETY_CLAMAV_HOST: ${MESSAGE_SAFETY_CLAMAV_HOST:-clamd}
-  MESSAGE_SAFETY_CLAMAV_PORT: ${MESSAGE_SAFETY_CLAMAV_PORT:-3310}
+  MESSAGE_SAFETY_ANTIVIRUS_SOCKET: /run/han-kesl/scan.sock
   MESSAGE_SAFETY_ARTIFACTS_DIR: ${MESSAGE_SAFETY_ARTIFACTS_DIR:-/app/app/artifacts}
   MESSAGE_SAFETY_MODE_FILE: /etc/han-chat/message-safety-mode.env
   PG_CA_FILE: /run/config/postgresql-ca.pem
@@ -169,49 +168,6 @@ services:
     mem_limit: 64m
     cpus: 0.25
 
-  clamd:
-    <<: *hardening
-    image: ${CLAMAV_IMAGE:?set immutable ClamAV image digest}
-    entrypoint: ["/init-unprivileged"]
-    user: "100:101"
-    command: ["clamd", "--foreground=true"]
-    volumes:
-      - clamav-signatures:/var/lib/clamav:ro
-      - clamav-runtime:/run/clamav
-    tmpfs:
-      - /tmp:rw,noexec,nosuid,nodev,size=64m
-      - /var/log/clamav:rw,noexec,nosuid,nodev,size=32m,uid=100,gid=101,mode=0750
-    networks: [backend]
-    expose: ["3310"]
-    healthcheck:
-      test: ["CMD-SHELL", "clamdscan --ping 1 >/dev/null 2>&1"]
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 60s
-    pids_limit: 300
-    mem_limit: 2g
-    cpus: 2.0
-
-  freshclam:
-    <<: *hardening
-    image: ${CLAMAV_IMAGE:?set immutable ClamAV image digest}
-    entrypoint: ["/init-unprivileged"]
-    user: "100:101"
-    command: ["freshclam", "--daemon", "--foreground", "--checks=12"]
-    volumes:
-      - clamav-signatures:/var/lib/clamav
-      - clamav-runtime:/run/clamav
-    tmpfs:
-      - /tmp:rw,noexec,nosuid,nodev,size=64m
-      - /var/log/clamav:rw,noexec,nosuid,nodev,size=32m,uid=100,gid=101,mode=0750
-    healthcheck:
-      disable: true
-    networks: [signature-egress]
-    pids_limit: 100
-    mem_limit: 256m
-    cpus: 0.5
-
   otel-queue-init:
     <<: *hardening
     image: ${REDIS_IMAGE:?set immutable Redis image digest}
@@ -270,6 +226,7 @@ services:
       MESSAGE_SAFETY_PROCESS_ROLE: api
     volumes:
       - /etc/han-chat/message-safety-mode.env:/etc/han-chat/message-safety-mode.env:ro
+      - /run/han-kesl:/run/han-kesl:ro
       - *postgres-ca-volume
     tmpfs:
       - /tmp:rw,noexec,nosuid,nodev,size=64m
@@ -306,6 +263,7 @@ services:
       MESSAGE_SAFETY_PROCESS_ROLE: worker
     volumes:
       - /etc/han-chat/message-safety-mode.env:/etc/han-chat/message-safety-mode.env:ro
+      - /run/han-kesl:/run/han-kesl:ro
       - *postgres-ca-volume
     tmpfs:
       - /tmp:rw,noexec,nosuid,nodev,size=256m
@@ -322,8 +280,6 @@ services:
     depends_on:
       redis-safety:
         condition: service_healthy
-      clamd:
-        condition: service_healthy
     pids_limit: 400
     mem_limit: 2g
     cpus: 2.0
@@ -465,13 +421,10 @@ networks:
     internal: true
   safety-egress:
   bitrix-egress:
-  signature-egress:
   telemetry-egress:
 
 volumes:
   redis-safety-data:
-  clamav-signatures:
-  clamav-runtime:
   otel-queue:
 
 secrets: