Configuration Reference
Environment Variables
The container reads its configuration from the environment: section of the docker-compose.yml file. The packaged compose file already sets the values shown in the Default column. To change a value, edit the environment: section and restart the container with docker compose up -d.
The following table lists the environment variables you can set:
|
Variable |
Description |
Default |
|---|---|---|
|
PORT |
Server listen port. If you change this, also update the ports: mapping and the URL in the compose file's healthcheck: section. |
3001 |
|
BIND_ADDRESS |
Interface the app listens on inside the container. Keep 0.0.0.0 in Docker; the ports: mapping cannot reach the app otherwise. Who can connect from outside is controlled by the ports: mapping. The default 127.0.0.1:3001:3001 allows connections from the Docker host only. |
0.0.0.0 (in the compose file) |
|
CORS_ORIGIN |
Allowed origin for cross-origin browser requests. Not needed for the toolkit's own UI, which calls the API from the same origin whatever address it is opened on. |
http://localhost:{port} |
|
QVSA_OVA_PATH |
Path of the Qualys virtual scanner OVA used for VMware deployments. Set it to the file name of your qVSA OVA. For new scanner deployments, always use the latest qVSA image from the Qualys platform to stay up to date with fixes and security patches. The Docker Compose distribution mounts your local qvsa directory at this path. |
/app/qvsa/qVSA.x86_64-4.2.21-1.ova (in the compose file) |
The compose file publishes the toolkit on the Docker host only (127.0.0.1). If you change the ports: mapping to make it reachable from other machines, put a reverse proxy with TLS and authentication in front of it and restrict access with a firewall. Never expose the toolkit to the public internet.
Qualys Platform URLs
Use the following table to find the API URL for your Qualys platform:
|
Platform |
API URL |
|---|---|
|
US1 |
https://qualysapi.qualys.com |
|
US2 |
https://qualysapi.qg2.apps.qualys.com |
|
US3 |
https://qualysapi.qg3.apps.qualys.com |
|
US4 |
https://qualysapi.qg4.apps.qualys.com |
|
GOV1 |
https://qualysapi.gov1.qualys.us |
|
EU1 |
https://qualysapi.qualys.eu |
|
EU2 |
https://qualysapi.qg2.apps.qualys.eu |
|
EU3 |
https://qualysapi.qg3.apps.qualys.it |
|
IN1 |
https://qualysapi.qg1.apps.qualys.in |
|
CA1 |
https://qualysapi.qg1.apps.qualys.ca |
|
AE1 |
https://qualysapi.qg1.apps.qualys.ae |
|
UK1 |
https://qualysapi.qg1.apps.qualys.co.uk |
|
AU1 |
https://qualysapi.qg1.apps.qualys.com.au |
|
KSA1 |
https://qualysapi.qg1.apps.qualysksa.com |
To find your platform, log in to the Qualys UI and go to Help > About, then check the SOC value.
API Rate Limits
Qualys enforces per-subscription API concurrency and rate limits. Before running a batch replacement with concurrency greater than 1, review your subscription's limits: https://cdn2.qualys.com/docs/qualys-api-limits.pdf. If you see repeated 409 errors during a batch run, reduce the concurrency setting to 1 (sequential) or verify with your Qualys account team whether your subscription's API rate limit needs to be increased.