66 lines
2.1 KiB
TOML
66 lines
2.1 KiB
TOML
# Komodo Resource Sync - docker-vuln-scan (git repo mode)
|
|
#
|
|
# Import this file with a Komodo Resource Sync (Syncs -> New Resource Sync ->
|
|
# Git Repo) pointing at this repo. See komodo/README.md for the full walkthrough.
|
|
#
|
|
# Before applying:
|
|
# 1. Replace `server` with the name of the Komodo Server to scan on.
|
|
# 2. Replace `repo` with the git repo that contains this project.
|
|
# 3. Create a Komodo Variable named APPRISE_URLS (mark it Secret).
|
|
# 4. Adjust IMAGES below or replace it with [[SCAN_IMAGES]] and create that
|
|
# variable instead.
|
|
|
|
[[stack]]
|
|
name = "vuln-scan"
|
|
description = "Trivy image vulnerability scan with Apprise notifications"
|
|
tags = ["security"]
|
|
# The scan is started by the Procedure below, not during sync.
|
|
deploy = false
|
|
|
|
[stack.config]
|
|
server = "server-prod"
|
|
repo = "your-org/docker-vuln-scan"
|
|
branch = "main"
|
|
file_paths = ["docker-compose.yml"]
|
|
run_directory = ""
|
|
# Build the scanner image on the Komodo server (no registry required).
|
|
run_build = true
|
|
# Do NOT try to pull docker-vuln-scan:latest from a registry.
|
|
auto_pull = false
|
|
# The scanner is a one-shot container, so an exited service is expected.
|
|
ignore_services = ["vulnscan"]
|
|
# Apprise already reports findings; avoid "stack down" noise in Komodo.
|
|
send_alerts = false
|
|
environment = """
|
|
IMAGES = nginx:1.27-alpine redis:7-alpine
|
|
APPRISE_URLS = [[APPRISE_URLS]]
|
|
APPRISE_TITLE_PREFIX = Vulnerability scan
|
|
NOTIFY_MIN_SEVERITY = HIGH
|
|
FAIL_ON = HIGH
|
|
IGNORE_UNFIXED = false
|
|
MAX_FINDINGS_IN_BODY = 15
|
|
"""
|
|
|
|
[[procedure]]
|
|
name = "vuln-scan"
|
|
description = "Rebuild and run the image vulnerability scan"
|
|
tags = ["security"]
|
|
|
|
[procedure.config]
|
|
schedule_format = "Cron"
|
|
# Every day at 03:00:00. Komodo cron has 6 fields (seconds first).
|
|
schedule = "0 0 3 * * ?"
|
|
schedule_timezone = "UTC"
|
|
schedule_enabled = true
|
|
# Findings are notified directly through Apprise.
|
|
schedule_alert = false
|
|
# Komodo alert if the build/deploy itself fails (needs a Komodo Alerter).
|
|
failure_alert = true
|
|
|
|
[[procedure.config.stage]]
|
|
name = "Run scanner"
|
|
executions = [
|
|
# DeployStack (not DeployStackIfChanged) forces the one-shot scanner to run.
|
|
{ execution.type = "DeployStack", execution.params.stack = "vuln-scan" },
|
|
]
|