# =============================================================================
# PQCrypta Discovery Agent — Linux configuration (ALL options for Linux)
# =============================================================================
# This is the complete, editable path catalog for Linux. When you run the agent
# with --config pointing at this file, THESE scan_paths are authoritative —
# the binary uses exactly what's listed here and nothing else. (Run with no
# --config at all and the binary falls back to its built-in Linux defaults,
# which are identical to the list below.)
#
# To narrow a scan: delete the paths you don't want. To widen it: add your own.
#
# Path expansion: ~ = the running user's home; $JAVA_HOME, $ORACLE_HOME and any $VAR / ${VAR} expand from the environment.
# Native stores are ALWAYS scanned regardless of this list: (none — Linux has no OS-level cert store; Java/PKCS12 keystores found in these paths are parsed).
#
# Usage: pqcrypta-discovery --config linux.toml
# =============================================================================

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# -----------------------------------------------------------------------------
# Filesystem scan paths — the full built-in Linux catalog (keystores found here
# are opened and each certificate inside is inventoried individually).
# -----------------------------------------------------------------------------
scan_paths = [
    '/root',
    '/etc/letsencrypt/live/',
    '/etc/letsencrypt/archive/',
    '/etc/letsencrypt/renewal/',
    '/var/lib/letsencrypt/',
    # pqcrypta-proxy's own ACME store. On any host fronted by the proxy this —
    # not /etc/letsencrypt — is where the live serving certificates are, so a
    # scan that skips it misses the certs that are actually terminating TLS.
    '/etc/pqcrypta/certs/',
    '/etc/ssl/certs/',
    '/etc/ssl/private/',
    '/usr/share/ca-certificates/',
    '/usr/local/share/ca-certificates/',
    '/etc/pki/tls/certs/',
    '/etc/pki/tls/private/',
    '/etc/pki/ca-trust/',
    '/etc/pki/nssdb/',
    '/etc/ssl/certs/java/',
    '/usr/lib/jvm/',
    '/opt/java/',
    '/etc/ssh/',
    '~/.ssh/',
    '/etc/strongswan/',
    '/etc/ipsec.d/certs/',
    '/etc/ipsec.d/private/',
    '/etc/openvpn/',
    '/etc/wireguard/',
    '/etc/postfix/ssl/',
    '/etc/dovecot/ssl/',
    '/etc/exim4/ssl/',
    '/etc/mail/ssl/',
    '/etc/apache2/ssl/',
    '/etc/httpd/ssl/',
    '/etc/nginx/ssl/',
    '/etc/nginx/certs/',
    '/etc/haproxy/certs/',
    '/etc/haproxy/ssl/',
    '/etc/envoy/certs/',
    '/etc/traefik/certs/',
    '/etc/certs/',
    '/etc/istio/proxy/',
    '/var/run/linkerd/tls/',
    '/var/run/linkerd/identity/',
    '/var/run/secrets/',
    '/var/run/secrets/kubernetes.io/serviceaccount/',
    '/var/run/secrets/istio/',
    '/var/run/secrets/tokens/',
    '/opt/vault/tls/',
    '/etc/vault.d/certs/',
    '/etc/consul.d/certs/',
    '/etc/nomad.d/certs/',
    '/var/lib/postgresql/',
    '/etc/pgsql/ssl/',
    '/etc/mysql/ssl/',
    '/etc/mysql/certs/',
    '/etc/mongodb/ssl/',
    '/etc/oracle/wallet/',
    '/etc/couchdb/certs/',
    '/etc/redis/ssl/',
    '/home/db2inst1/sqllib/cfg/ssl/',
    '/etc/rabbitmq/ssl/',
    '/etc/kafka/ssl/',
    '/opt/kafka/ssl/',
    '/etc/activemq/ssl/',
    '/etc/zeromq/ssl/',
    '/etc/openldap/certs/',
    '/etc/ldap/certs/',
    '/etc/ldap/ssl/',
    '/etc/dirsrv/',
    '/etc/krb5.keytab',
    '/var/kerberos/krb5kdc/',
    '/etc/heimdal/',
    '/usr/sap/',
    '/opt/oracle/fmw/wallet/',
    '/opt/ps/ssl/',
    '/etc/docker/certs.d/',
    '/etc/containers/certs.d/',
    '/etc/kubernetes/pki/',
    '/var/lib/docker/',
    '/var/lib/kubelet/pki/',
    '/var/lib/lxd/ssl/',
    '/etc/openconnect/',
    '/opt/cisco/anyconnect/ssl/',
    '/config/ssl/',
    '/nsconfig/ssl/',
    '/opt/pancfg/ssl/',
    '/conf/ssl/',
    '/var/db/certs/',
    'disk0:/certs/',
    '/flash/certs/',
    '/opt/CPsuite-R80/conf/certs/',
    '/opt/CPsuite-R81/conf/certs/',
    '/etc/a10/ssl/',
    '/etc/nginx/conf.d/ssl/',
    '/etc/iot/certs/',
    '/usr/lib/softhsm/',
    '/usr/lib/pkcs11/',
    '/usr/lib64/pkcs11/',
    '/opt/*/pkcs11/',
    '~/.gnupg/',
    '/etc/gnupg/',
    '/usr/share/gnupg/',
    '/usr/local/share/gnupg/',
    '~/.m2/',
    '~/.gradle/',
    '~/.docker/certs.d/',
    '~/.minikube/certs/',
    '~/.kube/',
    '~/certs/',
    '~/ssl/',
    '~/.pip/certs/',
    '~/.config/pip/',
    '~/.ansible/certs/',
    '~/.terraform.d/certs/',
    '~/.aws/',
    '~/.azure/',
    '~/.config/gcloud/',
    '~/.cargo/',
    '~/.gem/',
    '~/.helm/',
    '~/.config/helm/',
    '~/.postgresql/',
    '~/.mysql/',
    '~/.subversion/',
    '~/.android/',
    '~/.vmware/',
    '~/.config/VirtualBox/',
    '~/.thunderbird/',
    '/var/lib/jenkins/certs/',
    '/etc/gitlab-runner/certs/',
    '/home/*/snap/',
    '/var/lib/puppet/ssl/',
    '/etc/puppetlabs/puppet/ssl/',
    '/etc/chef/client.pem',
    '/etc/chef/trusted_certs/',
    '/etc/salt/pki/',
    '/etc/prometheus/certs/',
    '/etc/grafana/certs/',
    '/etc/elasticsearch/certs/',
    '/etc/kibana/certs/',
    '/etc/logstash/certs/',
    '/etc/etcd/ssl/',
    '/opt/zookeeper/ssl/',
    '/var/lib/acme/',
    '/etc/lego/',
    '/etc/cert-manager/',
    '/var/lib/libvirt/pki/',
    '/etc/crypto/',
    '/var/ssl/certs/',
    '/var/ssl/private/',
    '/opt/',
    '/var/lib/ssl/',
    '/usr/local/etc/ssl/',
    '/srv/ssl/',
    '/home/ssl/',
    '~/.pki/',
    '~/keystores/',
    '/opt/tomcat/',
    '/var/lib/tomcat/',
    '/usr/share/tomcat/',
    '/opt/oracle/',
    '/u01/app/oracle/',
    '/opt/jboss/',
    '/opt/wildfly/',
]

# Paths never descended into (applies to every scan_path above).
# Exclusions are OPT-IN: leave this commented and nothing is excluded. Uncomment
# it (and edit to taste) to skip pseudo-filesystems and scratch dirs — strongly
# recommended if you add broad roots or run with --full-disk-scan, so the walk
# doesn't churn through /proc and /sys.
# excluded_paths = [
#     '/proc',
#     '/sys',
#     '/dev',
#     '/tmp',
# ]

# Deep scan: also parse files without a recognized certificate/key extension
# (slower, finds keys hidden in .txt/.bak/.old files). Same as --deep-scan.
deep_scan = false

# Only report specific algorithms (omit to report all).
# algorithms_filter = ["RSA", "ECC"]

# -----------------------------------------------------------------------------
# Live TLS endpoints (additive): inventory the cert actually served on each.
# -----------------------------------------------------------------------------
# [[network_targets]]
# host = "example.com"
# port = 443

# -----------------------------------------------------------------------------
# Database column scanning (opt-in): postgres/mysql/sqlite/mssql/oracle.
# -----------------------------------------------------------------------------
# [[database_connections]]
# name = "Production PostgreSQL"
# db_type = "postgres"
# dsn = "postgres://readonly:password@localhost:5432/mydb"
# excluded_tables = []
# excluded_columns = []

# -----------------------------------------------------------------------------
# Source code scanning — CBOM (opt-in): weak-crypto API calls, 20+ languages.
# -----------------------------------------------------------------------------
# code_scan_paths = ["/opt/myapp/src"]
code_scan_paths = []

# -----------------------------------------------------------------------------
# Network appliance inventory (opt-in): F5 BIG-IP / Citrix NetScaler via mgmt API.
# -----------------------------------------------------------------------------
# [[appliance_targets]]
# name = "F5 BIG-IP Production"
# appliance_type = "f5"              # "f5" or "netscaler"
# mgmt_url = "https://f5-mgmt.example.com"
# username = "readonly-user"
# password = "your-password-here"
# verify_tls = true

# -----------------------------------------------------------------------------
# Submission tuning (optional).
# -----------------------------------------------------------------------------
# How many assets go in each submission request, and how many requests are in
# flight at once. The defaults suit a normal network; lower them for a slow or
# constrained link. Both can also be set per-run with --submit-batch-size and
# --submit-concurrency.
# submit_batch_size = 100
# submit_concurrency = 6

# -----------------------------------------------------------------------------
# Keystore passwords (optional)
# -----------------------------------------------------------------------------
# Passwords tried, in order, against locked keystores (PKCS#12/PFX, JKS, JCEKS)
# IN ADDITION to the built-in well-known defaults (empty, "changeit",
# "password"). There is no lockout on a local keystore file, so trying a list is
# safe: the first password that opens a given container wins, and none need to
# be mapped to a specific store.
#
# A container that stays locked is reported as a GAP IN COVERAGE rather than a
# clean result — an unopened keystore and an empty one otherwise look identical
# in an inventory — so supplying these is what turns "unknown" into findings.
#
# SECURITY: passwords are used only LOCALLY to open containers on this host. One
# is never submitted to the API, never logged, and never leaves the machine;
# only the (already cleartext) certificate metadata inside is reported.
#
# Inline — simplest, but the secrets then live in this file:
# keystore_passwords = ["app-keystore-pw", "legacy-jks-pw"]
#
# From a file — newline-separated, blank lines and `#` comments ignored. Keeps
# this config shareable while the secrets sit in a tighter-permissioned file:
# keystore_passwords_file = "/etc/pqcrypta/keystore-passwords.txt"
#
# From a command — stdout, newline-separated. The universal hook for any secrets
# manager without a bespoke integration:
# keystore_passwords_command = "vault kv get -field=pw secret/keystores"
#   ...or: "aws secretsmanager get-secret-value --query SecretString --output text"
#   ...or: "op read op://vault/item/password"
#   ...or: "gpg -d /etc/pqcrypta/passwords.gpg"
#
# All four sources merge; they are not alternatives.
