# clamd settings ProjectSend depends on.
#
# The three Alert* options are not cosmetic. Without them clamd answers
# "OK" for a file it could not actually look inside — an encrypted archive,
# or one that hit a size limit — and ProjectSend would record a clean scan
# for a file nobody scanned. With them, those come back as
# Heuristics.Encrypted.* and Heuristics.Limits.Exceeded.*, which the client
# maps to "encrypted" and "too large" rather than to a threat, and this
# installation's own policy decides what happens to the file.

LogTime yes
Foreground yes

# Listen for the application on this network only. There is no
# authentication in this protocol; see the note in compose.yaml.
#
# No TCPAddr, so clamd listens on every address the container has. The
# image's health check asks "localhost", which resolves to ::1 first, and
# with TCPAddr 0.0.0.0 that check failed forever while clamd worked.
TCPSocket 3310

# The largest stream clamd will accept. ProjectSend refuses anything over
# its own "largest file to scan" setting before it gets here, and that
# setting must not exceed this number.
StreamMaxLength 512M
MaxFileSize 512M
MaxScanSize 1024M

# Archive limits, which is where zip bombs live. Reaching one is reported
# rather than passed, thanks to AlertExceedsMax below.
MaxRecursion 16
MaxFiles 10000

AlertExceedsMax yes
AlertEncrypted yes
AlertEncryptedArchive yes
AlertEncryptedDoc yes