networks:
  DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
    external: true

services:
  trivy-service: #LIBREPORTAL|SERVICE_TAG_1|trivy-service
    container_name: trivy-service
    image: aquasec/trivy:latest #LIBREPORTAL|TRIVY_VERSION_TAG|latest
    restart: unless-stopped
    # Keep the container process ALIVE even when the vuln DB can't be fetched.
    # `trivy server` FATAL-exits if it can't download the DB on first boot (no
    # internet / registry unreachable); bare, restart:unless-stopped then crash-
    # loops it, and on rootless docker that restart storm churns the shared
    # network's port-forwarder until the WebUI's own published port is torn down.
    # Wrapping the server in a shell retry-loop means the container stays Up and
    # quietly retries on a backoff instead of exiting — no restart, no churn. The
    # backend already reports the scanner as db_updating/absent until a DB lands.
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        while true; do
          trivy server --listen 0.0.0.0:4954
          echo "[libreportal] trivy server exited ($?) — vuln DB unavailable or offline; staying up, retrying in ${TRIVY_RETRY_SECS:-300}s (scanning paused until the DB is reachable)."
          sleep "${TRIVY_RETRY_SECS:-300}"
        done
    # GLUETUN_OFF_BEGIN
    ports:
      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
    # GLUETUN_OFF_END
    environment:
      - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
      - TRIVY_CACHE_DIR=/cache
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
      # TRAEFIK_PORT_1_BEGIN
      traefik.http.routers.trivy-service.entrypoints: web,websecure
      traefik.http.routers.trivy-service.rule: Host(`DOMAINSUBNAME_DATA_1`) #LIBREPORTAL|DOMAINSUBNAME_TAG_1|DOMAINSUBNAME_DATA_1
      traefik.http.routers.trivy-service.tls: true
      traefik.http.routers.trivy-service.tls.certresolver: production
      traefik.http.services.trivy-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
      traefik.http.routers.trivy-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
      # TRAEFIK_PORT_1_END
      traefik.docker.network: DOCKER_NETWORK_DATA #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
    healthcheck:
      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
    volumes:
      - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
      - ./trivy-cache:/cache
    # GLUETUN_OFF_BEGIN
    networks:
      DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
        ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
    # GLUETUN_OFF_END
    # GLUETUN_ON_BEGIN
    # network_mode: "container:gluetun-service"
    # GLUETUN_ON_END