Initial commit

.env.example

@@ -0,0 +1,59 @@
+# Copy to .env and adjust. Do not commit real credentials.
+
+# Images to scan, space separated (quote the value).
+# Leave empty/unset to scan the images used by running containers.
+# IMAGES=nginx:1.27-alpine redis:7-alpine
+
+# Optional: file with one image per line ('#' comments allowed).
+# IMAGES_FILE=images.txt
+
+# Host path of the Docker socket to mount. Needed for auto-discovery and for
+# scanning images that exist only in the local daemon. Rootless Docker uses
+# /run/user/<uid>/docker.sock.
+# DOCKER_SOCK=/var/run/docker.sock
+
+# Also scan the scanner's own image when auto-discovering (default: false).
+# INCLUDE_SELF=false
+
+# One or more Apprise URLs, space separated. Quote the value.
+# Examples:
+#   mailto://user:app-password@gmail.com
+#   discord://webhook_id/webhook_token
+#   slack://token_a/token_b/token_c
+#   tgram://bot_token/chat_id
+#   gotify://hostname/token
+APPRISE_URLS=
+
+# Optional: Apprise YAML config (mount it into the container).
+# APPRISE_CONFIG=/config/apprise.yml
+
+APPRISE_TITLE_PREFIX=Vulnerability scan
+
+# Lowest severity that sends an alert (NONE disables notifications).
+NOTIFY_MIN_SEVERITY=HIGH
+
+# Lowest severity that makes the scan exit with code 1 (NONE never fails).
+FAIL_ON=HIGH
+
+# Skip vulnerabilities that have no fixed version available.
+IGNORE_UNFIXED=false
+
+# Optional: restrict which severities Trivy reports (empty = all).
+TRIVY_SEVERITIES=
+
+# How many findings to list in the notification body.
+MAX_FINDINGS_IN_BODY=15
+
+# Send an Apprise alert when Trivy itself fails (default: true).
+NOTIFY_ON_SCAN_ERROR=true
+
+# Timeout for each image scan.
+TRIVY_TIMEOUT=15m
+
+# Log verbosity: DEBUG, INFO, WARN or ERROR.
+LOG_LEVEL=INFO
+
+# Optional: credentials for private registries.
+# TRIVY_USERNAME=
+# TRIVY_PASSWORD=
+# TRIVY_INSECURE=false