# Komodo Resource Sync - docker-vuln-scan (files on host mode)
#
# Use this variant if you do not want Komodo to clone the project from git.
# Copy the project to the Komodo host at:
#
#   /etc/komodo/stacks/vuln-scan/
#
# (that is the default Periphery root directory, mounted at the same path in the
# standard Komodo compose setup; adjust if you changed PERIPHERY_ROOT_DIRECTORY)
#
# Then apply this file with a Komodo Resource Sync. See komodo/README.md.
#
# Before applying:
#   1. Replace `server` with the name of the Komodo Server to scan on.
#   2. Create a Komodo Variable named APPRISE_URLS (mark it Secret).
#   3. Adjust IMAGES below or replace it with [[SCAN_IMAGES]].

[[stack]]
name = "vuln-scan"
description = "Trivy image vulnerability scan with Apprise notifications"
tags = ["security"]
deploy = false

[stack.config]
server = "server-prod"
files_on_host = true
# Relative to /etc/komodo/stacks/vuln-scan/. Empty means the project root.
run_directory = ""
file_paths = ["docker-compose.yml"]
run_build = true
auto_pull = false
ignore_services = ["vulnscan"]
send_alerts = false
environment = """
IMAGES = nginx:1.27-alpine redis:7-alpine
APPRISE_URLS = [[APPRISE_URLS]]
APPRISE_TITLE_PREFIX = Vulnerability scan
NOTIFY_MIN_SEVERITY = HIGH
FAIL_ON = HIGH
IGNORE_UNFIXED = false
# Containers with outside access that get a full per-container notification.
# IMPORTANT_CONTAINERS = traefik web-frontend
MAX_FINDINGS_IN_BODY = 15
"""

[[procedure]]
name = "vuln-scan"
description = "Rebuild and run the image vulnerability scan"
tags = ["security"]

[procedure.config]
schedule_format = "Cron"
schedule = "0 0 3 * * ?"
schedule_timezone = "UTC"
schedule_enabled = true
schedule_alert = false
failure_alert = true

[[procedure.config.stage]]
name = "Run scanner"
executions = [
  { execution.type = "DeployStack", execution.params.stack = "vuln-scan" },
]