# PQCrypta Discovery Agent — Linux Mail Server preset
# For hosts running Postfix / Dovecot / Exim / Sendmail / OpenDKIM.
# Covers MTA/MDA TLS certs, DKIM signing keys, Let's Encrypt, SASL/LDAP, and
# live checks of the certificates actually served on every mail protocol port.
#
# Usage: pqcrypta-discovery --config linux-mail-server.toml
#
# Tip: leaving scan_paths = [] instead would use the built-in comprehensive
# per-OS defaults (100+ locations) — this preset narrows to mail-server dirs
# for faster, more focused scans. The paths listed REPLACE the defaults.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

scan_paths = [
    # MTAs / MDAs (whole config trees: cert paths vary by distro & setup)
    "/etc/postfix",
    "/etc/dovecot",
    "/etc/exim4",
    "/etc/exim",
    "/etc/mail",
    "/etc/sendmail",
    # DKIM / DMARC signing keys
    "/etc/opendkim",
    "/etc/dkim",
    "/etc/dkimkeys",
    "/var/lib/rspamd/dkim",
    # ACME / Let's Encrypt (mail certs commonly live here)
    "/etc/letsencrypt/live",
    "/etc/letsencrypt/archive",
    # pqcrypta-proxy ACME store — on a proxy-fronted host this is where the
    # certificates actually terminating TLS live, not /etc/letsencrypt.
    "/etc/pqcrypta/certs",
    # System TLS
    "/etc/ssl/certs",
    "/etc/ssl/private",
    "/etc/pki/tls",
    # SASL / LDAP auth backends
    "/etc/sasl2",
    "/etc/openldap/certs",
    "/etc/ldap",
    # Webmail / groupware
    "/etc/roundcube",
    "/var/www",
    # SSH
    "/etc/ssh",
    "/root/.ssh",
]

excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
    "/var/spool",     # mail queues: large, no certs, may hold private mail
    "/var/mail",
    "/var/vmail",
]

deep_scan = false

# Verify the certificate actually served on each mail protocol — catches
# stale reloads and per-service cert mismatches (Postfix and Dovecot are
# configured independently and drift apart easily).
#
# 465/993/995 are implicit TLS. 25/587/143/110 are plaintext protocols that
# upgrade via STARTTLS, and the agent negotiates that upgrade for you (EHLO ->
# STARTTLS for SMTP, `a001 STARTTLS` for IMAP, `STLS` for POP3) before the
# handshake. If a port turns out to be implicit TLS after all, the scan retries
# it as such rather than reporting nothing. Ports not listening are simply
# skipped with a warning, so leaving all seven here is safe on a host that only
# runs some of them.
[[network_targets]]
host = "localhost"
port = 25      # SMTP (STARTTLS)

[[network_targets]]
host = "localhost"
port = 465     # SMTPS

[[network_targets]]
host = "localhost"
port = 587     # Submission (STARTTLS)

[[network_targets]]
host = "localhost"
port = 143     # IMAP (STARTTLS)

[[network_targets]]
host = "localhost"
port = 993     # IMAPS

[[network_targets]]
host = "localhost"
port = 110     # POP3 (STARTTLS)

[[network_targets]]
host = "localhost"
port = 995     # POP3S

code_scan_paths = []
