How teudanrichard/clamav-rest works
ClamAV HTTP Gateway accepts scan requests, enforces bounded streaming and concurrency, speaks ClamAV’s INSTREAM protocol, and returns typed clean/infected results. The graph covers both upload modes, health/version endpoints, optional OIDC, and observability. Source excerpts establish the application’s calls; deployment and Helm capabilities are documented in the README, but their runtime wiring is not sampled, so they are represented as a separate documented subsystem with limited links.
Main entry points: main.py HTTP Routes · socket_client.py Socket Protocol Client · compose.yaml Container and Compose · clamav-rest Kubernetes Helm Chart
Components 20
HTTP Gateway
- HTTP Routes
app/main.py - API Models
app/models.py - Runtime Settings
app/config.py - Release Version
app/version.py
Scan Processing
- Raw Stream Scan
app/main.py - Multipart Scan
app/main.py - Scan Admission
app/main.py
ClamAV Backend
- Socket Protocol Client
app/socket_client.py - ClamAV Daemon
- Health and Readiness
app/main.py - Engine Version Route
app/main.py
Authentication
- Auth Dependency
app/auth/__init__.py - OIDC Verifier
app/auth/oidc.py
Operations
- Request Observability
app/observability.py - Prometheus Metrics
app/observability.py - Container and Compose
compose.yaml - Kubernetes Helm Chart
charts/clamav-rest - Signature Storage
Other components
- API Client
- OIDC Provider
Connections 23
- API Client → HTTP Routes: calls API
README.md - HTTP Routes → API Models: returns typed results
app/main.py - HTTP Routes → Runtime Settings: loads settings
app/main.py - Runtime Settings → Release Version: reads version
app/config.py - HTTP Routes → Raw Stream Scan: routes raw body
app/main.py - HTTP Routes → Multipart Scan: routes file upload
app/main.py - Raw Stream Scan → Scan Admission: acquires scan slot
app/main.py - Multipart Scan → Scan Admission: acquires upload slot
app/main.py - Scan Admission → Socket Protocol Client: scans chunks
app/main.py - Health and Readiness → Socket Protocol Client: pings daemon
app/main.py - Engine Version Route → Socket Protocol Client: requests version
app/main.py - Socket Protocol Client → ClamAV Daemon: sends protocol commands
README.md - HTTP Routes → Health and Readiness: serves probes
app/main.py - HTTP Routes → Engine Version Route: serves version
app/main.py - HTTP Routes → Auth Dependency: protects routes
app/main.py - Auth Dependency → OIDC Verifier: validates when enabled
app/auth/__init__.py - OIDC Verifier → OIDC Provider: fetches discovery and keys
app/auth/oidc.py - HTTP Routes → Request Observability: installs middleware
app/main.py - HTTP Routes → Prometheus Metrics: mounts when enabled
app/main.py - Container and Compose → ClamAV Daemon: runs separate service
README.md - Container and Compose → Signature Storage: persists signatures
README.md - Kubernetes Helm Chart → ClamAV Daemon: optional sidecar service
README.md - Kubernetes Helm Chart → Signature Storage: supports persistent signatures
README.md