strixd

Overview ¶

Command strixd is the standalone YARA scanner backend for rspamd. rspamd has no native YARA module (as of 4.1.0), so the mailstrix.lua plugin POSTs message or MIME-part bytes here over HTTP and strixd scans them against a compiled YARA rule set, returning the matched rule names. It mirrors the gozer backend's shape: one authenticated HTTP endpoint (/scan), /health and /metrics, every option settable by env var or CLI flag, and a health subcommand for the distroless HEALTHCHECK (no shell or curl in the image).

Usage:

strixd [serve] [flags]      run the HTTP backend on MAILSTRIX_HOST:MAILSTRIX_PORT
strixd scan [flags] [path…] scan files/dirs (or stdin) locally, print matches
strixd check-rules [flags]  compile the rule set, report count, exit non-zero on fail
strixd extract [flags][path] dump what the extractor carves from a file (no scan)
strixd health               probe the local /health endpoint (HEALTHCHECK)
strixd version              print the version

`strixd scan` compiles the same rule set in-process and scans without the HTTP server, so it works for one-off triage and pipelines, e.g.

strixd scan suspicious.doc                 # one file
strixd scan /var/mail/cur                  # a maildir (recursed)
strixd scan - < /var/mail/cur/123:2,S      # a maildir file on stdin
cat msg.eml | strixd scan                  # no path => stdin too

SIGHUP recompiles the rule set without dropping the listener, so a rules refresh (new image layer bind-mounted, or an operator edit) takes effect with `docker kill -s HUP yarad`.