# PQCrypta Discovery Agent — Windows Server preset
# For domain controllers, IIS/Exchange/SQL Server hosts, and infrastructure
# roles (AD CS, ADFS, NPS, WSUS, Hyper-V, SCCM). The Windows Certificate
# Store (CryptoAPI) is ALWAYS scanned natively in addition to these paths.
#
# Usage: pqcrypta-discovery.exe --config windows-server.toml
#        Run elevated — BitLocker/TPM posture checks and several of these
#        directories need administrator rights.
#
# TOML note: single-quoted 'literal strings' so backslashes need no escaping.
#
# Tip: leaving scan_paths = [] instead would use the built-in comprehensive
# Windows defaults — this preset narrows to server-role dirs for faster,
# more focused scans. The paths listed REPLACE the defaults.

api_url = "https://api.pqcrypta.com"
api_key = "YOUR-API-KEY-HERE"

scan_paths = [
    # Machine crypto stores on disk
    'C:\ProgramData\Microsoft\Crypto\',
    'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Crypto\',
    # Active Directory Certificate Services / Group Policy / ADFS
    'C:\Windows\System32\CertSrv\CertEnroll\',
    'C:\Windows\System32\GroupPolicy\Machine\Microsoft\Windows\Certificates\',
    'C:\ProgramData\Microsoft\ADFS\',
    'C:\Program Files\ADFS\',
    # IIS / Exchange / SQL Server
    'C:\inetpub\ssl\',
    'C:\inetpub\history\',
    'C:\Program Files\Microsoft\Exchange Server\',
    'C:\Program Files\Microsoft SQL Server\',
    'C:\ProgramData\Microsoft\Microsoft SQL Server\',
    # Remote access / clustering / management planes
    'C:\ProgramData\Microsoft\Network\Connections\',
    'C:\Windows\Cluster\',
    'C:\ProgramData\Microsoft\Windows\Hyper-V\',
    'C:\ProgramData\Microsoft\Network Policy Server\',
    'C:\Windows\System32\RemoteManagement\Certificates\',
    'C:\Program Files\Microsoft Configuration Manager\',
    'C:\Program Files\Update Services\Certs\',
    'C:\ProgramData\Microsoft\Intune\Certs\',
    # Common .pfx/.pem drop locations
    'C:\ProgramData\ssl\',
    'C:\ProgramData\certs\',
    'C:\ssl\',
    'C:\certs\',
    # Admin SSH keys
    'C:\Users\Administrator\.ssh\',
    'C:\ProgramData\ssh\',
]

excluded_paths = [
    'C:\Windows\WinSxS',
    'C:\Windows\Temp',
    'C:\$Recycle.Bin',
]

deep_scan = false

# Verify the TLS actually served by this host's roles.
[[network_targets]]
host = "localhost"
port = 443     # IIS / Exchange OWA

# [[network_targets]]
# host = "localhost"
# port = 3389    # RDP
#
# [[network_targets]]
# host = "localhost"
# port = 636     # LDAPS (domain controllers)
#
# [[network_targets]]
# host = "localhost"
# port = 1433    # SQL Server (if TLS-enforced)

# Scan inside SQL Server for certs/keys stored in table columns (opt-in):
# [[database_connections]]
# name = "SQL Server"
# db_type = "mssql"
# dsn = "mssql://readonly:password@localhost:1433/mydb"

code_scan_paths = []
