2429/single clamav

[George-Hudson]

Summary of Changes

In order to preserve cf space in dev and staging, we are reducing the number of ClamAV instances we are using. Only the ClamAV instance in the prod space will be used. We also created NGINX servers to act as gatekeepers for each space and to forward requests to the production ClamAV server.

Pull request closes #2429

How to Test

• the ClamAV scan needs function as intended when running through the gatekeeper.

Deliverables

More details on how deliverables herein are assessed included here.

Deliverable 1: Accepted Features

Checklist of ACs:

• [ClamAV scans still work appropriately]
• lfrohlich and/or adpennington confirmed that ACs are met.

Deliverable 2: Tested Code

• Are all areas of code introduced in this PR meaningfully tested?
  • If this PR introduces backend code changes, are they meaningfully tested?
  • If this PR introduces frontend code changes, are they meaningfully tested?
• Are code coverage minimums met?
  • Frontend coverage: [insert coverage %] (see CodeCov Report comment in PR)
  • Backend coverage: [insert coverage %] (see CodeCov Report comment in PR)

Deliverable 3: Properly Styled Code

• Are backend code style checks passing on CircleCI?
• Are frontend code style checks passing on CircleCI?
• Are code maintainability principles being followed?

Deliverable 4: Accessible

• Does this PR complete the epic?
• Are links included to any other gov-approved PRs associated with epic?
• Does PR include documentation for Raft's a11y review?
• Did automated and manual testing with iamjolly and ttran-hub using Accessibility Insights reveal any errors introduced in this PR?

Deliverable 5: Deployed

• Was the code successfully deployed via automated CircleCI process to development on Cloud.gov?

Deliverable 6: Documented

• Does this PR provide background for why coding decisions were made?
• If this PR introduces backend code, is that code easy to understand and sufficiently documented, both inline and overall?
• If this PR introduces frontend code, is that code easy to understand and sufficiently documented, both inline and overall?
• If this PR introduces dependencies, are their licenses documented?
• Can reviewer explain and take ownership of these elements presented in this code review?

Deliverable 7: Secure

• Does the OWASP Scan pass on CircleCI?
• Do manual code review and manual testing detect any new security issues?
• If new issues detected, is investigation and/or remediation plan documented?

Deliverable 8: User Research

Research product(s) clearly articulate(s):

• the purpose of the research
• methods used to conduct the research
• who participated in the research
• what was tested and how
• impact of research on TDP
• (if applicable) final design mockups produced for TDP development

[jtimpe]

lgtm! just one question for clarification

[raftmsohani]

LGTM!

[ADPennington]

@George-Hudson @raftmsohani getting the following result in logs when submitting a file:

17:01:20.841: [APP/PROC/WEB.0] 2023-10-05 21:01:20,840 ERROR clients.py::scan_file:L74 :  ClamAV connection failure: HTTPSConnectionPool(host='tdp-clamav-nginx-dev.apps.internal', port=9000): Max retries exceeded with url: /scan (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)')))
17:01:20.841: [APP/PROC/WEB.0] ClamAV connection failure: HTTPSConnectionPool(host='tdp-clamav-nginx-dev.apps.internal', port=9000): Max retries exceeded with url: /scan (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:997)')))

[ADPennington]

looks great @George-Hudson @raftmsohani 🚀

file scan via nginx router in tdp-backend-qasp logs

file being scanned in prod clamav instance

scan results saved in DAC in qasp env only (also verified that prod apps unaffected by scans in dev env