# Copy to .env and adjust. Do not commit real credentials.

# Images to scan, space separated (quote the value).
# Leave empty/unset to scan the images used by running containers.
# IMAGES=nginx:1.27-alpine redis:7-alpine

# Optional: file with one image per line ('#' comments allowed).
# IMAGES_FILE=images.txt

# Host path of the Docker socket to mount. Needed for auto-discovery and for
# scanning images that exist only in the local daemon. Rootless Docker uses
# /run/user/<uid>/docker.sock.
# DOCKER_SOCK=/var/run/docker.sock

# Also scan the scanner's own image when auto-discovering (default: false).
# INCLUDE_SELF=false

# One or more Apprise URLs, space separated. Quote the value.
# Examples:
#   mailto://user:app-password@gmail.com
#   discord://webhook_id/webhook_token
#   slack://token_a/token_b/token_c
#   tgram://bot_token/chat_id
#   gotify://hostname/token
APPRISE_URLS=

# Optional: Apprise YAML config (mount it into the container).
# APPRISE_CONFIG=/config/apprise.yml

APPRISE_TITLE_PREFIX=Vulnerability scan

# Lowest severity that sends an alert (NONE disables notifications).
NOTIFY_MIN_SEVERITY=HIGH

# Lowest severity that makes the scan exit with code 1 (NONE never fails).
FAIL_ON=HIGH

# Skip vulnerabilities that have no fixed version available.
IGNORE_UNFIXED=false

# Optional: restrict which severities Trivy reports (empty = all).
TRIVY_SEVERITIES=

# Optional: VEX sources passed to `trivy image --vex`, space separated.
# Use "repo", "oci", "sbom-ref", local file paths, or a combination.
# Mount local files into the container first (e.g. ./vex:/vex:ro).
# TRIVY_VEX=repo
# TRIVY_VEX=/vex/app.json

# How many findings to list in the notification body.
MAX_FINDINGS_IN_BODY=15

# Send an Apprise alert when Trivy itself fails (default: true).
NOTIFY_ON_SCAN_ERROR=true

# Timeout for each image scan.
TRIVY_TIMEOUT=15m

# Log verbosity: DEBUG, INFO, WARN or ERROR.
LOG_LEVEL=INFO

# Optional: credentials for private registries.
# TRIVY_USERNAME=
# TRIVY_PASSWORD=
# TRIVY_INSECURE=false