From 8e8c8b086c74de10e4bdf9868f9505f8955f6279 Mon Sep 17 00:00:00 2001
From: devops <devops@local>
Date: Wed, 16 Sep 2026 13:58:14 +0000
Subject: [PATCH] security: Trivy ko gate banaya, registry asli TLS hostname
 par, base image patched

---
 .trivyignore      |  5 +++++
 Dockerfile        |  7 +++++++
 Jenkinsfile       | 10 ++++++----
 deploy/deploy.yml |  2 +-
 4 files changed, 19 insertions(+), 5 deletions(-)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..2edc302
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,5 @@
+# Yahan sirf wo CVE daalo jinka business ne risk accept kiya hai.
+# Format: ek line me ek CVE id, uske upar comment me kyun aur kab tak.
+# Misaal:
+#   # CVE-2024-12345 - sirf us feature me hai jo hum use nahi karte. Review: 2026-12-01
+#   CVE-2024-12345
diff --git a/Dockerfile b/Dockerfile
index d546e66..3b74726 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,12 @@
 FROM python:3.12-slim
 
+# Base image hafton purana ho sakta hai. Security updates yahin laga do,
+# warna pipeline ka Trivy gate HIGH/CRITICAL par build rok dega.
+RUN apt-get update \
+ && apt-get upgrade -y \
+ && apt-get autoremove -y --purge \
+ && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /srv
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
diff --git a/Jenkinsfile b/Jenkinsfile
index 13d546c..a9fd7bb 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -7,7 +7,7 @@ pipeline {
     }
 
     environment {
-        REGISTRY   = '51.195.4.170:5000'
+        REGISTRY   = 'ns31240276.ip-51-195-4.eu:5000'
         IMAGE_NAME = 'swim/demo-app'
         VAULT_ADDR = 'http://vault:8200'
         // Jenkins container ka workspace /var/jenkins_home/... hai, par docker
@@ -122,15 +122,17 @@ print('  Vault se registry creds mil gaye (user=%s)' % d['username'])
             when { expression { env.IS_ROLLBACK != 'true' } }
             steps {
                 sh '''
-                    # Trivy ko docker socket chahiye taaki local image scan kar sake.
-                    # Cache volume se dobara download nahi hoga.
+                    # GATE hai, report nahi: HIGH/CRITICAL mila to build yahin fail hogi.
+                    # Jo CVE business ne accept kiye hain wo .trivyignore me hain.
                     docker run --rm \
                       -v /var/run/docker.sock:/var/run/docker.sock \
                       -v trivy-cache:/root/.cache/ \
+                      -v "$PWD/.trivyignore:/.trivyignore:ro" \
                       aquasec/trivy:0.58.1 image \
                         --severity ${TRIVY_SEVERITY} \
                         --ignore-unfixed \
-                        --exit-code 0 \
+                        --ignorefile /.trivyignore \
+                        --exit-code 1 \
                         --format table \
                         ${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
                 '''
diff --git a/deploy/deploy.yml b/deploy/deploy.yml
index b49a8a4..583e273 100644
--- a/deploy/deploy.yml
+++ b/deploy/deploy.yml
@@ -5,7 +5,7 @@
   gather_facts: true
 
   vars:
-    registry: "51.195.4.170:5000"
+    registry: "ns31240276.ip-51-195-4.eu:5000"
     image_name: "swim/demo-app"
     image_tag: "{{ lookup('env', 'IMAGE_TAG') | default('latest', true) }}"
     container_name: "demo-app"