Initial commit

komodo/vuln-scan.toml

@@ -0,0 +1,65 @@
+# Komodo Resource Sync - docker-vuln-scan (git repo mode)
+#
+# Import this file with a Komodo Resource Sync (Syncs -> New Resource Sync ->
+# Git Repo) pointing at this repo. See komodo/README.md for the full walkthrough.
+#
+# Before applying:
+#   1. Replace `server` with the name of the Komodo Server to scan on.
+#   2. Replace `repo` with the git repo that contains this project.
+#   3. Create a Komodo Variable named APPRISE_URLS (mark it Secret).
+#   4. Adjust IMAGES below or replace it with [[SCAN_IMAGES]] and create that
+#      variable instead.
+
+[[stack]]
+name = "vuln-scan"
+description = "Trivy image vulnerability scan with Apprise notifications"
+tags = ["security"]
+# The scan is started by the Procedure below, not during sync.
+deploy = false
+
+[stack.config]
+server = "server-prod"
+repo = "your-org/docker-vuln-scan"
+branch = "main"
+file_paths = ["docker-compose.yml"]
+run_directory = ""
+# Build the scanner image on the Komodo server (no registry required).
+run_build = true
+# Do NOT try to pull docker-vuln-scan:latest from a registry.
+auto_pull = false
+# The scanner is a one-shot container, so an exited service is expected.
+ignore_services = ["vulnscan"]
+# Apprise already reports findings; avoid "stack down" noise in Komodo.
+send_alerts = false
+environment = """
+IMAGES = nginx:1.27-alpine redis:7-alpine
+APPRISE_URLS = [[APPRISE_URLS]]
+APPRISE_TITLE_PREFIX = Vulnerability scan
+NOTIFY_MIN_SEVERITY = HIGH
+FAIL_ON = HIGH
+IGNORE_UNFIXED = false
+MAX_FINDINGS_IN_BODY = 15
+"""
+
+[[procedure]]
+name = "vuln-scan"
+description = "Rebuild and run the image vulnerability scan"
+tags = ["security"]
+
+[procedure.config]
+schedule_format = "Cron"
+# Every day at 03:00:00. Komodo cron has 6 fields (seconds first).
+schedule = "0 0 3 * * ?"
+schedule_timezone = "UTC"
+schedule_enabled = true
+# Findings are notified directly through Apprise.
+schedule_alert = false
+# Komodo alert if the build/deploy itself fails (needs a Komodo Alerter).
+failure_alert = true
+
+[[procedure.config.stage]]
+name = "Run scanner"
+executions = [
+  # DeployStack (not DeployStackIfChanged) forces the one-shot scanner to run.
+  { execution.type = "DeployStack", execution.params.stack = "vuln-scan" },
+]