# PQCrypta Discovery Agent — Network Appliance Inventory preset
# F5 BIG-IP and Citrix NetScaler/ADC are closed appliances no agent can run
# on. This preset inventories their certificate stores over their own
# management APIs (F5 iControl REST / NetScaler NITRO) instead — including
# spare/staged certificates not currently bound to a live virtual server.
# Device facts are collected too (software version, platform, CPU/memory,
# management IP, interfaces) so each appliance shows up as its own device in
# the Compliance Dashboard. A read-only account (F5 Auditor role / NetScaler
# read-only command policy) is sufficient.
#
# Run it from ANY machine that can reach the appliances' management
# interfaces (a jump host or admin workstation is typical). Filesystem
# scanning is narrowed to nothing relevant so this config does appliance
# inventory only — combine with another preset if the jump host itself
# should also be scanned.
#
# Usage: pqcrypta-discovery --config network-appliances.toml
#
# Credentials: use a READ-ONLY appliance account. The password sits in this
# file in plaintext — chmod 600 it.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# Keep the filesystem scan minimal — the point of this preset is the
# appliances. (An empty list would trigger the full built-in default scan of
# the local machine.)
scan_paths = ["/etc/ssl/certs"]

excluded_paths = ["/proc", "/sys", "/dev", "/tmp"]

deep_scan = false
code_scan_paths = []

[[appliance_targets]]
name = "F5 BIG-IP Production"
appliance_type = "f5"                    # iControl REST
mgmt_url = "https://f5-mgmt.example.com"
username = "readonly-user"
password = "your-password-here"
verify_tls = true                        # false only for self-signed mgmt certs

# [[appliance_targets]]
# name = "NetScaler ADC"
# appliance_type = "netscaler"           # NITRO API
# mgmt_url = "https://netscaler-mgmt.example.com"
# username = "readonly-user"
# password = "your-password-here"
# verify_tls = true

# Also inventory the TLS actually served by their virtual servers (optional):
# [[network_targets]]
# host = "vip.example.com"
# port = 443
