config.json.tmpl

{
  "comments": [
    "# Configuration file for malware-scanner service.",
    "# ----",
    "#",
    "# 'buckets' is a list of objects specifying source/destination buckets for scanning, allowing the service to handle multiple buckets",
    "# Each object must have the 3 properties 'unscanned', 'clean' and 'quarantined', specifying the bucket names to use.",
    "#",
    "# 'ClamCvdMirrorBucket' is a GCS bucket used to mirror the clamav database definition files to prevent overloading the Clam servers",
    "# and being rate limited/blacklisted. Its contents are maintained by the updateCvdMirror.sh script",
    "#",
    "# Shell environmental variable substitution is supported in this file.",
    "# At runtime, it will be copied to /etc",
    "#",
    "# 'fileExclusionPatterns' is a list of regular expressions. Files matching any",
    "# of these patterns will be skipped during scanning. NOTE: These files will remain",
    "# in the 'unscanned' bucket and will need to be tidied and/or managed separately.",
    "# Regular expressions can be expressed as simple strings",
    "# or as an array of 2 strings,  the pattern and regexp flags, such as 'i' for case insensitive matching",
    "#",
    "#",
    "# Example:",
    "#",
    "#   'fileExclusionPatterns: [",
    "#     '\\.filepart$',  (Ignore files ending in '.filepart')",
    "#     '^ignore_me.*\\.txt$',  (Ignore files starting with 'ignore_me' and ending with '.txt')",
    "#     [ '\\.tmp$', 'i' ], (Case insensitive match for files ending in .TMP, .tmp, .TmP etc)",
    "#   ]",
    "#",
    "# Reference and Cheat sheet for regular expressions:",
    "# https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions",
    "# https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions/Cheatsheet",
    "#",
    "# As an alternative to including this file in the container the contents can be passed as an enviroment variable CONFIG_JSON on",
    "# Cloud Run startup",
    "#",
    "# quarantine.encryptedFiles (default true) to quarantine all encrypted Files (eg zip,rar,pdf) with a pseudo-virus Heuristics.Encrypted.xxx",
    "#",
    "# quarantine.fileExtensionAllowList is a list of string file extensions which will only be allowed.",
    "# Files not matching extensions in this list will be quarantined, even if they do not contain malware, with a pseudo-virus Config.AllowList.Blocked",
    "# Leave blank to allow all files.",
    "# Multiple extensions (eg: tar.gz) are supported.",
    "# The empty string (\"\") will match files without an extension",
    "#",
    "# quarantine.fileExtensionDenyList is a list of string file extensions which will only be allowed.",
    "# Files not matching extensions in this list will be quarantined, even if they do not contain malware, with a pseudo-virus Config.DenyList.Blocked",
    "# Leave blank to allow all files.",
    "# Multiple extensions (eg: tar.gz) are supported.",
    "# The empty string (\"\") will match files without an extension",
    "#",
    "# Note: This comments property is optional and can be removed.",
    "#",
    "# cleanRescanIntervalDays: how old last-clamav-scan metadata must be before a clean-bucket object is rescanned (scheduled job).",
    "# cleanRescanMaxObjectsPerRun: max objects to scan per scheduler invocation (spread load on large buckets).",
    "# cleanRescanMetadataKey: GCS custom metadata key for last scan time (ISO 8601); HTTP form is x-goog-meta-<key>."
  ],
  "buckets": [
    {
      "unscanned": "unscanned-bucket-name",
      "clean": "clean-bucket-name",
      "quarantined": "quarantined-bucket-name"
    }
  ],
  "ClamCvdMirrorBucket": "cvd-mirror-bucket-name",
  "cleanRescanIntervalDays": 30,
  "cleanRescanMaxObjectsPerRun": 100,
  "cleanRescanMetadataKey": "last-clamav-scan",
  "fileExclusionPatterns": [],
  "ignoreZeroLengthFiles": false,
  "quarantine": {
    "encryptedFiles": true,
    "fileExtensionAllowList": [],
    "fileExtensionDenyList": []
  }
}