# PQCrypta Discovery Agent — Linux Web Server preset
# For hosts running nginx / Apache / HAProxy / Caddy serving TLS.
# Focused on web PKI: Let's Encrypt, server cert/key directories, SSH, and a
# live check of the certificate actually being served on :443.
#
# Usage: pqcrypta-discovery --config linux-web-server.toml
#
# Tip: leaving scan_paths = [] instead would use the built-in comprehensive
# per-OS defaults (100+ locations) — this preset narrows to web-server dirs
# for faster, more focused scans. The paths listed REPLACE the defaults.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

scan_paths = [
    # ACME / Let's Encrypt
    "/etc/letsencrypt/live",
    "/etc/letsencrypt/archive",
    "/var/lib/letsencrypt",
    # pqcrypta-proxy ACME store — on a proxy-fronted host this is where the
    # certificates actually terminating TLS live, not /etc/letsencrypt.
    "/etc/pqcrypta/certs",
    # System TLS
    "/etc/ssl/certs",
    "/etc/ssl/private",
    "/etc/pki/tls",
    "/usr/local/share/ca-certificates",
    # Web servers
    "/etc/nginx",
    "/etc/apache2",
    "/etc/httpd",
    "/etc/haproxy",
    "/etc/caddy",
    "/var/lib/caddy",
    # SSH host + user keys
    "/etc/ssh",
    "/root/.ssh",
    "/home",
    # App deployments commonly holding certs
    "/opt",
    "/srv",
]

excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
    "/var/cache",
]

deep_scan = false

# Verify what is actually served (catches load balancers / SNI mismatches /
# stale reloads where the file on disk is newer than the cert in memory).
[[network_targets]]
host = "localhost"
port = 443

# Add your public hostnames so the served chain is inventoried end-to-end:
# [[network_targets]]
# host = "www.example.com"
# port = 443

# Scan your web application's source for weak-crypto API calls (optional):
# code_scan_paths = ["/var/www/myapp"]
code_scan_paths = []
