From 4cde8728fa3bad2b6ccf0942f87df47b7a6f309f Mon Sep 17 00:00:00 2001
From: Local Dev <dev@localhost>
Date: Fri, 23 Oct 2026 21:28:42 +0300
Subject: [PATCH] prometheus: raise ClamAV size limits to match the 2 GiB
 upload cap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ClamAV ships with StreamMaxLength=25 MB, MaxFileSize=100 MB, MaxScanSize=
400 MB — mobile APKs over 25 MB came back as "INSTREAM size limit
exceeded" from the scanner, which the service wrapped in a 502 JSON
body, which Caddy sometimes replaced with its own HTML error page under
flaky mobile transport. The browser then saw 'Unexpected token <' and
told the user 'Network error'.

Overlay a minimal clamd.conf (mirrors the image default plus the three
raised limits, all pinned at 2 GiB = 2147483648 bytes) via a read-only
bind mount. Rebuild not needed — only clamav restarts.
---
 deploy/clamd.conf         | 26 ++++++++++++++++++++++++++
 deploy/docker-compose.yml |  5 +++++
 2 files changed, 31 insertions(+)
 create mode 100644 deploy/clamd.conf

diff --git a/deploy/clamd.conf b/deploy/clamd.conf
new file mode 100644
index 0000000..7be47a0
--- /dev/null
+++ b/deploy/clamd.conf
@@ -0,0 +1,26 @@
+# clamd.conf for Prometheus
+#
+# Overlays the ClamAV official image's default clamd.conf. The one change
+# that matters is the three size limits: Prometheus accepts files up to
+# 2 GiB (Caddy + MAX_FILE_BYTES both pinned there), and ClamAV's defaults
+# are much lower (StreamMaxLength 25 MB, MaxFileSize 100 MB, MaxScanSize
+# 400 MB). Without these overrides, a mobile APK over ~25 MB comes back
+# as `"INSTREAM size limit exceeded. ERROR"` and the service rejects it.
+#
+# The LogFile / LocalSocket / TCPSocket / User lines mirror the image's
+# default so dropping this file in via a bind mount doesn't lose anything.
+
+LogFile /var/log/clamav/clamd.log
+LogTime yes
+LocalSocket /tmp/clamd.sock
+TCPSocket 3310
+User clamav
+
+# --- size limits, raised to match Prometheus's 2 GiB upload cap ----------
+# INSTREAM is the TCP streaming scan path the service uses — the one that
+# returns "INSTREAM size limit exceeded" when the client sends too many
+# bytes. StreamMaxLength caps the stream; the other two cap the file and
+# the total scanned bytes (archives expand internally).
+StreamMaxLength 2147483648
+MaxFileSize 2147483648
+MaxScanSize 2147483648
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index bb25e44..679ace5 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -56,6 +56,11 @@ services:
       CLAMAV_NO_MILTERD: "true"
     volumes:
       - clamav-sigs:/var/lib/clamav
+      # Overlay our clamd.conf so the stream/file/scan size limits are
+      # raised from the image defaults (25 MB / 100 MB / 400 MB) to the
+      # 2 GiB cap Prometheus itself enforces. Without this a 100-MB APK
+      # scan comes back as "INSTREAM size limit exceeded".
+      - ./clamd.conf:/etc/clamav/clamd.conf:ro
     networks:
       - prometheus-internal
     expose: