# PQCrypta Discovery Agent — Kubernetes / Docker Host preset
# For container hosts: kubelet/control-plane PKI, container runtime certs,
# service-mesh identities, ingress secrets on disk, and etcd TLS.
#
# Usage: pqcrypta-discovery --config kubernetes-docker-host.toml
#
# Tip: leaving scan_paths = [] instead would use the built-in comprehensive
# per-OS defaults (100+ locations) — this preset narrows to container-infra
# dirs for faster, more focused scans. The paths listed REPLACE the defaults.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

scan_paths = [
    # Kubernetes control plane + kubelet PKI
    "/etc/kubernetes/pki",
    "/etc/kubernetes",
    "/var/lib/kubelet/pki",
    # etcd
    "/etc/etcd/ssl",
    "/var/lib/etcd",
    # Container runtimes
    "/etc/docker/certs.d",
    "/etc/containers/certs.d",
    "/var/lib/docker/swarm/certificates",
    "/var/lib/lxd/ssl",
    # Service mesh identities
    "/etc/istio/proxy",
    "/var/run/linkerd/tls",
    "/var/run/linkerd/identity",
    # Mounted secrets (service account tokens, projected certs)
    "/var/run/secrets",
    # cert-manager / ACME on hosts terminating ingress TLS
    "/etc/cert-manager",
    "/etc/letsencrypt/live",
    # pqcrypta-proxy ACME store — on a proxy-fronted host this is where the
    # certificates actually terminating TLS live, not /etc/letsencrypt.
    "/etc/pqcrypta/certs",
    # Admin/user client configs
    "/root/.kube",
    "/root/.minikube/certs",
    "/root/.docker",
    # System TLS + SSH
    "/etc/ssl/certs",
    "/etc/ssl/private",
    "/etc/ssh",
    "/root/.ssh",
]

excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
    # Container writable layers: enormous, ephemeral, and any certs inside
    # belong to the images' own inventory rather than the host's.
    "/var/lib/docker/overlay2",
    "/var/lib/containerd",
    "/var/log/pods",
]

deep_scan = false

# Verify the TLS actually served by the control plane and ingress.
[[network_targets]]
host = "localhost"
port = 6443    # kube-apiserver

# [[network_targets]]
# host = "localhost"
# port = 2379    # etcd client
#
# [[network_targets]]
# host = "localhost"
# port = 443     # ingress controller
#
# [[network_targets]]
# host = "localhost"
# port = 10250   # kubelet API

code_scan_paths = []
