# PQCrypta Discovery Agent — Developer / CI Build Server preset
# For machines that hold source code: developer workstations, CI runners,
# build servers, and git hosts. Centered on CBOM source scanning — finding
# weak-crypto API calls (MD5, SHA-1, DES/3DES, RC4, AES-ECB, undersized RSA
# key generation) in your own code before they ship — plus the signing keys,
# registry certs, and tool credentials these machines accumulate.
#
# Usage: pqcrypta-discovery --config developer-ci-server.toml
#        (edit code_scan_paths first — point it at YOUR source checkouts)

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# -----------------------------------------------------------------------------
# CBOM source scanning — the reason this preset exists. Point these at real
# source trees. 20+ languages are matched via each ecosystem's actual crypto
# idioms (OpenSSL/libcrypto, .NET BCL, JVM JCA, CommonCrypto/CryptoKit, Go
# stdlib, Node crypto, hashlib, ...) rather than just file extensions.
# Vendored/generated dirs are skipped automatically even inside a scanned
# tree: node_modules, vendor, target, venv, dist, build, .git.
# -----------------------------------------------------------------------------
code_scan_paths = [
    # Common source locations — trim to what exists on this machine:
    "/opt/src",
    "/srv/git",
    "/home/dev/projects",
    # CI runner workspaces (findings here reflect what's currently building):
    # "/home/gitlab-runner/builds",
    # "/var/lib/jenkins/workspace",
    # "/home/runner/work",              # GitHub Actions self-hosted
]

# Filesystem scanning: signing keys and certs that live on dev/CI machines.
scan_paths = [
    # Code / artifact signing
    "/etc/pki",
    "/opt/signing",
    # CI servers' own TLS + agent certs
    "/var/lib/jenkins/certs",
    "/etc/gitlab-runner/certs",
    "/etc/gitlab/ssl",
    # Container registry trust
    "/etc/docker/certs.d",
    "/etc/containers/certs.d",
    # Developer tool credentials (keys/certs inside dotfiles)
    "/root/.ssh",
    "/root/.gnupg",
    "/root/.docker",
    "/root/.kube",
    "/root/.aws",
    "/root/.cargo",
    "/root/.m2",
    "/root/.gradle",
    "/home",
    # System TLS + SSH
    "/etc/ssl/certs",
    "/etc/ssl/private",
    "/etc/ssh",
]

excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
    # Build outputs: huge, regenerated constantly, and their crypto findings
    # duplicate what CBOM already reports from the source itself.
    "/var/lib/docker/overlay2",
    "/home/*/node_modules",
    "/home/*/.cache",
]

deep_scan = false

# Verify TLS served by the forge/CI web UIs (optional):
# [[network_targets]]
# host = "git.example.com"
# port = 443
#
# [[network_targets]]
# host = "ci.example.com"
# port = 443
