# =============================================================================
# PQCrypta Discovery Agent — macOS configuration (ALL options for macOS)
# =============================================================================
# This is the complete, editable path catalog for macOS. When you run the agent
# with --config pointing at this file, THESE scan_paths are authoritative —
# the binary uses exactly what's listed here and nothing else. (Run with no
# --config at all and the binary falls back to its built-in macOS defaults,
# which are identical to the list below.)
#
# To narrow a scan: delete the paths you don't want. To widen it: add your own.
#
# Path expansion: ~ = the running user's home; no other variables are expanded.
# Native stores are ALWAYS scanned regardless of this list: the macOS Keychain (Security framework).
#
# Usage: pqcrypta-discovery --config macos.toml
# =============================================================================

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# -----------------------------------------------------------------------------
# Filesystem scan paths — the full built-in macOS catalog (keystores found here
# are opened and each certificate inside is inventoried individually).
# -----------------------------------------------------------------------------
scan_paths = [
    '/Users/admin',
    '/etc/ssl/',
    '/Library/Keychains/',
    '/System/Library/Keychains/SystemRootCertificates.keychain',
    '/System/Library/Keychains/SystemCACertificates.keychain',
    '/System/Library/Keychains/X509Anchors',
    '~/Library/Keychains/login.keychain-db',
    '~/Library/Keychains/CloudKitKeychain/',
    '~/Library/Keychains/',
    '/var/db/ConfigurationProfiles/',
    '/var/db/mdm/',
    '/Library/Preferences/',
    '/Library/Preferences/SystemConfiguration/',
    '~/Library/Mail/',
    '~/Library/Safari/',
    '~/Library/Application Support/',
    '~/Library/Application Support/Firefox/Profiles/',
    '~/Library/Application Support/Google/Chrome/',
    '/var/db/ConfigurationProfiles/Store/',
    '/Applications/Server.app/Contents/ServerRoot/private/etc/certificates/',
    '~/Library/MobileDevice/Provisioning Profiles/',
    '~/Library/Safari/Certificates/',
    '~/.m2/',
    '~/.gradle/',
    '~/.docker/certs.d/',
    '~/.minikube/certs/',
    '~/.kube/',
    '~/certs/',
    '~/ssl/',
    '~/.ansible/certs/',
    '~/.terraform.d/certs/',
    '~/.aws/',
    '~/.azure/',
    '~/.config/gcloud/',
    '~/.cargo/',
    '~/.gem/',
    '~/.nuget/',
    '~/.helm/',
    '~/.config/helm/',
    '~/.postgresql/',
    '~/.mysql/',
    '~/.subversion/',
    '~/Library/Android/sdk/',
    '~/.android/',
    '~/.vmware/',
    '~/.config/VirtualBox/',
    '~/Library/Thunderbird/',
    '/etc/ssh/',
    '~/.ssh/',
    '/usr/local/etc/openssl/',
    '/opt/homebrew/etc/openssl/',
    '/usr/local/opt/openssl/',
    '~/.gnupg/',
    '~/keystores/',
]

# Paths never descended into (applies to every scan_path above).
# Exclusions are OPT-IN: leave this commented and nothing is excluded. Uncomment
# it (and edit to taste) to skip scratch/VM dirs — strongly recommended if you add
# broad roots or run with --full-disk-scan, so the walk doesn't churn through
# /private/tmp and the VM swap store.
# excluded_paths = [
#     '/private/tmp',
#     '/dev',
#     '/System/Volumes/Data/private/var/vm',
# ]

# Deep scan: also parse files without a recognized certificate/key extension
# (slower, finds keys hidden in .txt/.bak/.old files). Same as --deep-scan.
deep_scan = false

# Only report specific algorithms (omit to report all).
# algorithms_filter = ["RSA", "ECC"]

# -----------------------------------------------------------------------------
# Live TLS endpoints (additive): inventory the cert actually served on each.
# -----------------------------------------------------------------------------
# [[network_targets]]
# host = "example.com"
# port = 443

# -----------------------------------------------------------------------------
# Database column scanning (opt-in): postgres/mysql/sqlite/mssql/oracle.
# -----------------------------------------------------------------------------
# [[database_connections]]
# name = "Production PostgreSQL"
# db_type = "postgres"
# dsn = "postgres://readonly:password@localhost:5432/mydb"
# excluded_tables = []
# excluded_columns = []

# -----------------------------------------------------------------------------
# Source code scanning — CBOM (opt-in): weak-crypto API calls, 20+ languages.
# -----------------------------------------------------------------------------
# code_scan_paths = ["/opt/myapp/src"]
code_scan_paths = []

# -----------------------------------------------------------------------------
# Network appliance inventory (opt-in): F5 BIG-IP / Citrix NetScaler via mgmt API.
# -----------------------------------------------------------------------------
# [[appliance_targets]]
# name = "F5 BIG-IP Production"
# appliance_type = "f5"              # "f5" or "netscaler"
# mgmt_url = "https://f5-mgmt.example.com"
# username = "readonly-user"
# password = "your-password-here"
# verify_tls = true

# -----------------------------------------------------------------------------
# Submission tuning (optional).
# -----------------------------------------------------------------------------
# How many assets go in each submission request, and how many requests are in
# flight at once. The defaults suit a normal network; lower them for a slow or
# constrained link. Both can also be set per-run with --submit-batch-size and
# --submit-concurrency.
# submit_batch_size = 100
# submit_concurrency = 6

# -----------------------------------------------------------------------------
# Keystore passwords (optional)
# -----------------------------------------------------------------------------
# Passwords tried, in order, against locked keystores (PKCS#12/PFX, JKS, JCEKS)
# IN ADDITION to the built-in well-known defaults (empty, "changeit",
# "password"). There is no lockout on a local keystore file, so trying a list is
# safe: the first password that opens a given container wins, and none need to
# be mapped to a specific store.
#
# A container that stays locked is reported as a GAP IN COVERAGE rather than a
# clean result — an unopened keystore and an empty one otherwise look identical
# in an inventory — so supplying these is what turns "unknown" into findings.
#
# SECURITY: passwords are used only LOCALLY to open containers on this host. One
# is never submitted to the API, never logged, and never leaves the machine;
# only the (already cleartext) certificate metadata inside is reported.
#
# Inline — simplest, but the secrets then live in this file:
# keystore_passwords = ["app-keystore-pw", "legacy-jks-pw"]
#
# From a file — newline-separated, blank lines and `#` comments ignored. Keeps
# this config shareable while the secrets sit in a tighter-permissioned file:
# keystore_passwords_file = "/etc/pqcrypta/keystore-passwords.txt"
#
# From a command — stdout, newline-separated. The universal hook for any secrets
# manager without a bespoke integration:
# keystore_passwords_command = "vault kv get -field=pw secret/keystores"
#   ...or: "aws secretsmanager get-secret-value --query SecretString --output text"
#   ...or: "op read op://vault/item/password"
#   ...or: "gpg -d /etc/pqcrypta/passwords.gpg"
#
# All four sources merge; they are not alternatives.
