all-in-one/nextcloud-aio-helm-chart/templates/nextcloud-aio-clamav-deployment.yaml

{{- if eq .Values.CLAMAV_ENABLED "yes" }}
apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
    kompose.version: 1.34.0 (cbf2835db)
  labels:
    io.kompose.service: nextcloud-aio-clamav
  name: nextcloud-aio-clamav
  namespace: "{{ .Values.NAMESPACE }}"
spec:
  replicas: 1
  selector:
    matchLabels:
      io.kompose.service: nextcloud-aio-clamav
  strategy:
    type: Recreate
  template:
    metadata:
      annotations:
        kompose.cmd: kompose convert -c -f latest.yml --namespace "{{ .Values.NAMESPACE }}"
        kompose.version: 1.34.0 (cbf2835db)
      labels:
        io.kompose.service: nextcloud-aio-clamav
    spec:
      securityContext:
        # The items below only work in pod context
        fsGroup: 100
        fsGroupChangePolicy: "OnRootMismatch"
        # The items below work in both contexts
        runAsUser: 100
        runAsGroup: 100
        runAsNonRoot: true
        {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
        seccompProfile:
          type: RuntimeDefault
        {{- end }}
      initContainers:
        - name: init-subpath
          image: "alpine:3.20"
          command:
            - mkdir
            - "-p"
            - /nextcloud-aio-clamav/data
          volumeMounts:
            - name: nextcloud-aio-clamav
              mountPath: /nextcloud-aio-clamav
          securityContext:
            # The items below only work in container context
            allowPrivilegeEscalation: false
            capabilities:
              {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
              drop: ["ALL"]
              {{- else }}
              drop: ["NET_RAW"]
              {{- end }}
              add: ["NET_BIND_SERVICE"]
      containers:
        - env:
            - name: CLAMD_STARTUP_TIMEOUT
              value: "90"
            - name: MAX_SIZE
              value: "{{ .Values.NEXTCLOUD_UPLOAD_LIMIT }}"
            - name: TZ
              value: "{{ .Values.TIMEZONE }}"
          image: nextcloud/aio-clamav:20241125_091756
          name: nextcloud-aio-clamav
          ports:
            - containerPort: 3310
              protocol: TCP
          securityContext:
            # The items below only work in container context
            allowPrivilegeEscalation: false
            capabilities:
              {{- if eq (.Values.RPSS_ENABLED | default "no") "yes" }}
              drop: ["ALL"]
              {{- else }}
              drop: ["NET_RAW"]
              {{- end }}
              add: ["NET_BIND_SERVICE"]
          volumeMounts:
            - mountPath: /var/lib/clamav
              subPath: data
              name: nextcloud-aio-clamav
      volumes:
        - name: nextcloud-aio-clamav
          persistentVolumeClaim:
            claimName: nextcloud-aio-clamav
{{- end }}