# PQCrypta Discovery Agent — Linux Database Server preset
# For hosts running PostgreSQL / MySQL-MariaDB / MongoDB / Redis / Oracle.
# Covers server TLS certs and client-auth material on disk, live checks of the
# TLS actually negotiated on each database port, and (opt-in) scanning INSIDE
# databases for certificates and keys stored in table columns.
#
# Usage: pqcrypta-discovery --config linux-database-server.toml
#
# Tip: leaving scan_paths = [] instead would use the built-in comprehensive
# per-OS defaults (100+ locations) — this preset narrows to database dirs
# for faster, more focused scans. The paths listed REPLACE the defaults.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

scan_paths = [
    # PostgreSQL (data dir holds server.crt/server.key; config may point elsewhere)
    "/var/lib/postgresql",
    "/etc/postgresql",
    "/etc/pgsql/ssl",
    # MySQL / MariaDB (auto-generated TLS lives in the data dir)
    "/var/lib/mysql",
    "/etc/mysql",
    # MongoDB / Redis / CouchDB
    "/etc/mongodb/ssl",
    "/etc/mongod.conf.d",
    "/etc/redis",
    "/etc/couchdb",
    # Oracle
    "/etc/oracle/wallet",
    "/opt/oracle",
    # System TLS + ACME
    "/etc/ssl/certs",
    "/etc/ssl/private",
    "/etc/pki/tls",
    "/etc/letsencrypt/live",
    # pqcrypta-proxy ACME store — on a proxy-fronted host this is where the
    # certificates actually terminating TLS live, not /etc/letsencrypt.
    "/etc/pqcrypta/certs",
    # Backup tooling that carries client certs
    "/etc/pgbackrest",
    "/etc/barman",
    # SSH
    "/etc/ssh",
    "/root/.ssh",
]

excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
    # Table/index/WAL data: huge and binary. The data-dir scan above still
    # catches server.crt/server.key at the data-dir root before descending here.
    "/var/lib/postgresql/*/main/base",
    "/var/lib/postgresql/*/main/pg_wal",
    "/var/lib/mysql/#innodb_redo",
]

deep_scan = false

# Verify the TLS actually negotiated on each database port.
[[network_targets]]
host = "localhost"
port = 5432    # PostgreSQL

[[network_targets]]
host = "localhost"
port = 3306    # MySQL / MariaDB

# [[network_targets]]
# host = "localhost"
# port = 27017   # MongoDB
#
# [[network_targets]]
# host = "localhost"
# port = 6379    # Redis (if TLS-enabled)

# Scan INSIDE the databases for certs/keys stored in table columns (opt-in).
# Use a READ-ONLY account. excluded_tables/excluded_columns let you skip
# audit blobs or this agent's own inventory tables.
#
# [[database_connections]]
# name = "Primary PostgreSQL"
# db_type = "postgres"
# dsn = "postgres://readonly:password@localhost:5432/mydb"
# excluded_tables = []
# excluded_columns = []
#
# [[database_connections]]
# name = "Primary MySQL"
# db_type = "mysql"
# dsn = "mysql://readonly:password@localhost:3306/mydb"

code_scan_paths = []
