{
  "schema": "router-machine-model-profile-v1",
  "machine_id": "vm101",
  "description": "WG Paid MGTS OpenWrt edge VM101",
  "rootfs_prefix": "rootfs",

  "ssh": {
    "outer_alias": "pve-mgts",
    "outer_connect_timeout_seconds": 10,
    "inner_user": "root",
    "inner_host": "10.71.100.2",
    "inner_identity_file": "/root/.ssh/pve_to_openwrt_mgts_ed25519",
    "inner_connect_timeout_seconds": 10,
    "strict_host_key_checking": true
  },

  "include_roots": [
    "/root/hmn",
    "/usr/local/bin",
    "/usr/local/sbin",
    "/usr/local/lib",
    "/etc/config",
    "/etc/init.d",
    "/etc/cron.d",
    "/etc/crontabs",
    "/etc/hotplug.d",
    "/etc/profile.d",
    "/etc/uci-defaults",
    "/etc/sysctl.d",
    "/etc/nftables.d",
    "/www/cgi-bin",
    "/etc/rc.local",
    "/etc/firewall.user"
  ],

  "scan_exclude_prefixes": [
    "/root/hmn/backups",
    "/root/hmn/test-runs",
    "/root/hmn/logs",
    "/root/hmn/cache",
    "/root/hmn/tmp"
  ],

  "public_exclude_globs": [
    "*/.ssh/*",
    "*/.ssh/**",
    "*/dropbear/*",
    "*/dropbear/**",
    "*/ssl/private/*",
    "*/ssl/private/**",
    "*/wireguard/*",
    "*/wireguard/**",
    "*.key",
    "**/*.key",
    "*.pem",
    "**/*.pem",
    "*.p12",
    "**/*.p12",
    "*.pfx",
    "**/*.pfx",
    ".env",
    "**/.env",
    "*.env",
    "**/*.env",
    "*secret*",
    "**/*secret*",
    "*token*",
    "**/*token*",
    "*credential*",
    "**/*credential*",
    "authorized_keys",
    "**/authorized_keys",
    "known_hosts",
    "**/known_hosts"
  ],

  "public_sanitize_prefixes": [
    "/etc/config"
  ],

  "public_sanitize_all_text_assignments": true,
  "public_binary_policy": "metadata_only",

  "sensitive_key_regex": "(?i)(password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?code|credential)",

  "validation": {
    "required_paths": [
      "/root/hmn/hmn-refresh-pool-safe.sh",
      "/root/hmn/hmn-code-test.sh",
      "/usr/local/lib/router-egress-vm101-runtime.sh"
    ],
    "required_shell_syntax_paths": [
      "/root/hmn/hmn-refresh-pool-safe.sh",
      "/root/hmn/hmn-code-test.sh",
      "/usr/local/lib/router-egress-vm101-runtime.sh"
    ]
  }
}