# =============================================================================
# PQCrypta Discovery Agent — Windows configuration (ALL options for Windows)
# =============================================================================
# This is the complete, editable path catalog for Windows. When you run the agent
# with --config pointing at this file, THESE scan_paths are authoritative —
# the binary uses exactly what's listed here and nothing else. (Run with no
# --config at all and the binary falls back to its built-in Windows defaults,
# which are identical to the list below.)
#
# To narrow a scan: delete the paths you don't want. To widen it: add your own.
#
# Path expansion: ~ = the running user's home; %USERPROFILE%, %ProgramFiles%, %SystemRoot%, %AppData%, %ProgramData% expand from the environment.
# Native stores are ALWAYS scanned regardless of this list: the Windows Certificate Store (CryptoAPI).
#
# Usage: pqcrypta-discovery.exe --config windows.toml   (run elevated for TPM/BitLocker posture)
# =============================================================================

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

# -----------------------------------------------------------------------------
# Filesystem scan paths — the full built-in Windows catalog (keystores found here
# are opened and each certificate inside is inventoried individually).
# -----------------------------------------------------------------------------
scan_paths = [
    'C:\Windows',
    'C:\Users\Administrator',
    'C:\Program Files',
    'C:\ProgramData\Microsoft\Crypto\',
    '%SystemRoot%\System32\config\systemprofile\AppData\Roaming\Microsoft\Crypto\',
    '%SystemRoot%\System32\CertSrv\CertEnroll\',
    '%SystemRoot%\System32\GroupPolicy\Machine\Microsoft\Windows\Certificates\',
    '%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\',
    'C:\ProgramData\Mozilla\',
    '%USERPROFILE%\AppData\Roaming\Microsoft\Crypto\',
    '%USERPROFILE%\AppData\Local\Microsoft\Crypto\',
    '%USERPROFILE%\.ssh\',
    'C:\inetpub\ssl\',
    '%ProgramFiles%\Microsoft\Exchange Server\',
    '%ProgramFiles%\Microsoft\Exchange Server\V15\ClientAccess\',
    'C:\ProgramData\Microsoft\Network\Connections\',
    '%SystemRoot%\Cluster\',
    'C:\ClusterStorage\',
    'C:\ProgramData\Microsoft\Windows\Hyper-V\',
    'C:\ProgramData\Microsoft\Network Policy Server\',
    'C:\ProgramData\Microsoft\Network Policy Server\Certificates\',
    'C:\ProgramData\Microsoft\Intune\Certs\',
    'C:\ProgramData\Microsoft\Security\Certificates\',
    '%AppData%\Opera Software\Opera Stable\',
    '%USERPROFILE%\AppData\Roaming',
    '%ProgramFiles%\Microsoft\System Center\',
    '%ProgramFiles%\Microsoft Configuration Manager\',
    'C:\ProgramData\Microsoft\ADFS\',
    '%ProgramFiles%\ADFS\',
    '%ProgramFiles%\Microsoft SQL Server\',
    'C:\ProgramData\Microsoft\Microsoft SQL Server\',
    'C:\ProgramData\ssl\',
    'C:\ProgramData\certs\',
    'C:\ssl\',
    'C:\certs\',
    '%ProgramFiles%\Update Services\Certs\',
    'C:\inetpub\history\',
    '%SystemRoot%\System32\RemoteManagement\Certificates\',
    'C:\ProgramData\Symantec\SSL\',
    'C:\ProgramData\McAfee\SSL\',
    'C:\ProgramData\Microsoft\Virtual Machine Manager\Certificates\',
    '%USERPROFILE%\.aspnet\https\',
    '%USERPROFILE%\Documents\IISExpress\config\',
    '%USERPROFILE%\AppData\Roaming\ASP.NET\Https\',
    '%USERPROFILE%\.docker\machine\certs\',
    '%USERPROFILE%\.docker\certs.d\',
    '%USERPROFILE%\.m2\',
    '%USERPROFILE%\.gradle\',
    '%USERPROFILE%\.kube\',
    '%USERPROFILE%\.aws\',
    '%USERPROFILE%\.azure\',
    '%USERPROFILE%\.config\gcloud\',
    '%USERPROFILE%\.cargo\',
    '%USERPROFILE%\.gem\',
    '%USERPROFILE%\.nuget\',
    '%USERPROFILE%\.helm\',
    '%USERPROFILE%\.postgresql\',
    '%USERPROFILE%\.mysql\',
    '%USERPROFILE%\.subversion\',
    '%USERPROFILE%\.android\',
    '%USERPROFILE%\.vmware\',
    '%USERPROFILE%\.config\VirtualBox\',
    '%USERPROFILE%\AppData\Roaming\Mozilla\Thunderbird\',
    'C:\ProgramData\',
    '%SystemRoot%\System32\',
    '%APPDATA%\keystores\\',
    '%PROGRAMDATA%\keystores\\',
]

# Paths never descended into (applies to every scan_path above).
# Exclusions are OPT-IN: leave this commented and nothing is excluded. Uncomment
# it (and edit to taste) to skip servicing/scratch dirs — strongly recommended if
# you add broad roots or run with --full-disk-scan, so the walk doesn't churn
# through WinSxS and Temp.
# excluded_paths = [
#     'C:\\Windows\\WinSxS',
#     'C:\\Windows\\Temp',
#     'C:\\$Recycle.Bin',
# ]

# Deep scan: also parse files without a recognized certificate/key extension
# (slower, finds keys hidden in .txt/.bak/.old files). Same as --deep-scan.
deep_scan = false

# Only report specific algorithms (omit to report all).
# algorithms_filter = ["RSA", "ECC"]

# -----------------------------------------------------------------------------
# Live TLS endpoints (additive): inventory the cert actually served on each.
# -----------------------------------------------------------------------------
# [[network_targets]]
# host = "example.com"
# port = 443

# -----------------------------------------------------------------------------
# Database column scanning (opt-in): postgres/mysql/sqlite/mssql/oracle.
# -----------------------------------------------------------------------------
# [[database_connections]]
# name = "Production PostgreSQL"
# db_type = "postgres"
# dsn = "postgres://readonly:password@localhost:5432/mydb"
# excluded_tables = []
# excluded_columns = []

# -----------------------------------------------------------------------------
# Source code scanning — CBOM (opt-in): weak-crypto API calls, 20+ languages.
# -----------------------------------------------------------------------------
# code_scan_paths = ["/opt/myapp/src"]
code_scan_paths = []

# -----------------------------------------------------------------------------
# Network appliance inventory (opt-in): F5 BIG-IP / Citrix NetScaler via mgmt API.
# -----------------------------------------------------------------------------
# [[appliance_targets]]
# name = "F5 BIG-IP Production"
# appliance_type = "f5"              # "f5" or "netscaler"
# mgmt_url = "https://f5-mgmt.example.com"
# username = "readonly-user"
# password = "your-password-here"
# verify_tls = true

# -----------------------------------------------------------------------------
# Submission tuning (optional).
# -----------------------------------------------------------------------------
# How many assets go in each submission request, and how many requests are in
# flight at once. The defaults suit a normal network; lower them for a slow or
# constrained link. Both can also be set per-run with --submit-batch-size and
# --submit-concurrency.
# submit_batch_size = 100
# submit_concurrency = 6

# -----------------------------------------------------------------------------
# Keystore passwords (optional)
# -----------------------------------------------------------------------------
# Passwords tried, in order, against locked keystores (PKCS#12/PFX, JKS, JCEKS)
# IN ADDITION to the built-in well-known defaults (empty, "changeit",
# "password"). There is no lockout on a local keystore file, so trying a list is
# safe: the first password that opens a given container wins, and none need to
# be mapped to a specific store.
#
# A container that stays locked is reported as a GAP IN COVERAGE rather than a
# clean result — an unopened keystore and an empty one otherwise look identical
# in an inventory — so supplying these is what turns "unknown" into findings.
#
# SECURITY: passwords are used only LOCALLY to open containers on this host. One
# is never submitted to the API, never logged, and never leaves the machine;
# only the (already cleartext) certificate metadata inside is reported.
#
# Inline — simplest, but the secrets then live in this file:
# keystore_passwords = ["app-keystore-pw", "legacy-jks-pw"]
#
# From a file — newline-separated, blank lines and `#` comments ignored. Keeps
# this config shareable while the secrets sit in a tighter-permissioned file:
# keystore_passwords_file = "/etc/pqcrypta/keystore-passwords.txt"
#
# From a command — stdout, newline-separated. The universal hook for any secrets
# manager without a bespoke integration:
# keystore_passwords_command = "vault kv get -field=pw secret/keystores"
#   ...or: "aws secretsmanager get-secret-value --query SecretString --output text"
#   ...or: "op read op://vault/item/password"
#   ...or: "gpg -d /etc/pqcrypta/passwords.gpg"
#
# All four sources merge; they are not alternatives.
