# =============================================================================
# PQCrypta Discovery Agent — FULL REFERENCE CONFIGURATION
# =============================================================================
# Every supported option, grouped by scan type, with defaults explained.
# Everything below the "API endpoint" section is optional — the smallest
# working config is just api_url + api_key.
#
# Usage:
#   Linux/macOS:  pqcrypta-discovery --config /path/to/agent-config.toml
#   Windows:      pqcrypta-discovery.exe --config C:\path\to\agent-config.toml
#
# Always scanned automatically, no configuration needed or possible:
#   - Native OS certificate store (Windows CryptoAPI / macOS Keychain)
#   - Java (JKS) and PKCS#12 keystores found inside any scanned path
#   - OS & security metadata (TPM, Secure Boot, disk encryption, firewall, ...)
# =============================================================================

# -----------------------------------------------------------------------------
# API endpoint (required to submit results; omit both and pass --output FILE
# to write results to a local JSON file instead)
# -----------------------------------------------------------------------------
api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# -----------------------------------------------------------------------------
# Filesystem scanning
# -----------------------------------------------------------------------------
# Paths to scan for certificates and private keys.
#
#   IMPORTANT: an EMPTY list (the default) means "use the built-in
#   comprehensive per-OS defaults" — 100+ locations covering Let's Encrypt,
#   system PKI, SSH, mail servers, web servers, VPNs, Kerberos, container
#   runtimes, browsers and developer tools for your platform. Listing paths
#   here REPLACES those defaults with only what you list.
scan_paths = []
# scan_paths = [
#     "/etc/ssl",
#     "/etc/letsencrypt",
#     "/opt/myapp/certs",
# ]

# Paths never descended into, even inside a scanned path.
excluded_paths = [
    "/proc",
    "/sys",
    "/dev",
    "/tmp",
]

# Deep scan: also parse files without a recognized certificate/key extension
# (slower, but finds keys hidden in .txt/.bak/.old files). Same as --deep-scan.
deep_scan = false

# Only report assets using specific algorithms. Empty/omitted = report all.
# algorithms_filter = ["RSA", "ECC"]

# -----------------------------------------------------------------------------
# Live TLS endpoint scanning (additive — runs alongside filesystem scanning)
# -----------------------------------------------------------------------------
# Connects to each host:port, captures the served certificate chain, and
# records the negotiated protocol. Use for services whose certs live outside
# the filesystem (load balancers, cloud endpoints, other machines).
#
# [[network_targets]]
# host = "example.com"
# port = 443
#
# [[network_targets]]
# host = "mail.example.com"
# port = 465
#
# [[network_targets]]
# host = "internal-db.local"
# port = 5432

# -----------------------------------------------------------------------------
# Database column scanning (opt-in)
# -----------------------------------------------------------------------------
# Inspects table columns for stored certificates, keys, and crypto material.
# Dispatch is by db_type: postgres, mysql, sqlite, mssql, oracle.
# Oracle requires Instant Client on the machine running the scan; Oracle
# targets are skipped gracefully when it isn't installed.
#
# [[database_connections]]
# name = "Production PostgreSQL"
# db_type = "postgres"
# dsn = "postgres://readonly:password@localhost:5432/mydb"
# # Tables/columns to skip (e.g. this agent's own inventory tables, audit blobs):
# excluded_tables = ["crypto_assets", "asset_scans"]
# excluded_columns = ["big_binary_blob"]
#
# [[database_connections]]
# name = "Legacy MySQL"
# db_type = "mysql"
# dsn = "mysql://readonly:password@localhost:3306/mydb"
#
# [[database_connections]]
# name = "Local SQLite"
# db_type = "sqlite"
# dsn = "sqlite:///opt/app/data.db"
#
# [[database_connections]]
# name = "SQL Server"
# db_type = "mssql"
# dsn = "mssql://readonly:password@localhost:1433/mydb"
#
# [[database_connections]]
# name = "Oracle"
# db_type = "oracle"
# dsn = "oracle://readonly:password@host:1521/ORCL"

# -----------------------------------------------------------------------------
# Source code scanning — CBOM (opt-in)
# -----------------------------------------------------------------------------
# Scans source trees for weak-crypto API calls (MD5, SHA-1, DES/3DES, RC4,
# AES-ECB, undersized RSA keygen) across 20+ languages using each ecosystem's
# real idioms. Point it at YOUR application source; vendored/generated dirs
# (node_modules, vendor, target, venv, dist, build, .git) are skipped
# automatically even inside a scanned tree.
#
# code_scan_paths = ["/opt/myapp/src", "/opt/myapp/internal"]
code_scan_paths = []

# -----------------------------------------------------------------------------
# Network appliance inventory (opt-in)
# -----------------------------------------------------------------------------
# F5 BIG-IP and Citrix NetScaler/ADC are closed appliances no agent can run
# on — instead the agent inventories their certificate store via the
# appliance's own management API (F5 iControl REST / NetScaler NITRO). This
# surfaces every cert on the box, including spare/staged certs not currently
# bound to a live virtual server. It also collects the device's own facts
# (software version, platform incl. Virtual Edition, CPU/memory, management
# IP, self-IPs, interfaces + MACs) so the appliance appears as its own device
# in the dashboard. A read-only account (F5 Auditor role / NetScaler read-only
# command policy) is sufficient. Run from any machine that can reach the
# management interface.
#
# [[appliance_targets]]
# name = "F5 BIG-IP Production"
# appliance_type = "f5"              # "f5" or "netscaler"
# mgmt_url = "https://f5-mgmt.example.com"
# username = "readonly-user"
# password = "your-password-here"
# verify_tls = true                  # false only for self-signed mgmt certs

# -----------------------------------------------------------------------------
# Keystore passwords (optional)
# -----------------------------------------------------------------------------
# Passwords tried, in order, against locked keystores (PKCS#12/PFX, JKS, JCEKS)
# IN ADDITION to the built-in well-known defaults (empty, "changeit",
# "password"). There is no lockout on a local keystore file, so trying a list is
# safe: the first password that opens a given container wins, and none need to
# be mapped to a specific store.
#
# A container that stays locked is reported as a GAP IN COVERAGE rather than a
# clean result — an unopened keystore and an empty one otherwise look identical
# in an inventory — so supplying these is what turns "unknown" into findings.
#
# SECURITY: passwords are used only LOCALLY to open containers on this host. One
# is never submitted to the API, never logged, and never leaves the machine;
# only the (already cleartext) certificate metadata inside is reported.
#
# Inline — simplest, but the secrets then live in this file:
# keystore_passwords = ["app-keystore-pw", "legacy-jks-pw"]
#
# From a file — newline-separated, blank lines and `#` comments ignored. Keeps
# this config shareable while the secrets sit in a tighter-permissioned file:
# keystore_passwords_file = "/etc/pqcrypta/keystore-passwords.txt"
#
# From a command — stdout, newline-separated. The universal hook for any secrets
# manager without a bespoke integration:
# keystore_passwords_command = "vault kv get -field=pw secret/keystores"
#   ...or: "aws secretsmanager get-secret-value --query SecretString --output text"
#   ...or: "op read op://vault/item/password"
#   ...or: "gpg -d /etc/pqcrypta/passwords.gpg"
#
# All four sources merge; they are not alternatives.

# -----------------------------------------------------------------------------
# Submission tuning (optional)
# -----------------------------------------------------------------------------
# How many assets go in each submission request, and how many requests are in
# flight at once. The defaults suit a normal network; lower them for a slow or
# constrained link. Both can also be set per-run with --submit-batch-size and
# --submit-concurrency. Neither applies to --offline-report, which submits
# nothing.
# submit_batch_size = 100
# submit_concurrency = 6
