make bucket-scan wordlist opt-in (default off)

Discovery is now driven purely by incoming CT domains (stem + suffix
expansion); the hardcoded generic-name wordlist is only used when
BUCKET_SCAN_WORDLIST=true.

.env.example

@@ -35,3 +35,4 @@ BUCKET_SCAN_QPS=50
 BUCKET_SCAN_WORKERS=16
 BUCKET_SCAN_QUEUE=65536
 BUCKET_SCAN_DO=false
+BUCKET_SCAN_WORDLIST=false

README.md

@@ -132,6 +132,7 @@ Environment variables only; no config files, no runtime pattern files.
 | `BUCKET_SCAN_WORKERS` | `16` | discovery probe workers |
 | `BUCKET_SCAN_QUEUE` | `65536` | sampled domain backlog |
 | `BUCKET_SCAN_DO` | `false` | also test DigitalOcean Spaces regions |
+| `BUCKET_SCAN_WORDLIST` | `false` | also test a built-in list of common generic names |
 | `DEDUP_TTL` | `1h` | hostname/finding dedup window |
 | `METRICS_ADDR` | `:9090` | metrics/health/UI listener |
 | `UI_USER` / `UI_PASS` | *(unset)* | optional HTTP basic auth for the web UI |

cmd/ctcloud/main.go

@@ -167,12 +167,16 @@ func run() error {
 			},
 		})
 		discoverer.Start(ctx)
+		wordlist := 0
+		if cfg.BucketScanWordlist {
 			for _, name := range discover.Wordlist() {
 				discoverer.SubmitName(name)
 			}
+			wordlist = len(discover.Wordlist())
+		}
 		slog.Info("bucket name discovery enabled", "event", "startup",
 			"qps", cfg.BucketScanQPS, "workers", cfg.BucketScanWorkers, "do_spaces", cfg.BucketScanDO,
-			"wordlist", len(discover.Wordlist()))
+			"wordlist", wordlist)
 	}
 
 	var prober *probe.Prober

internal/config/config.go

@@ -44,6 +44,7 @@ type Config struct {
 	BucketScanWorkers  int
 	BucketScanQueue    int
 	BucketScanDO       bool
+	BucketScanWordlist bool
 
 	MetricsAddr   string
 	UIUser        string
@@ -90,6 +91,7 @@ func Load() (*Config, error) {
 		BucketScanWorkers:  envInt("BUCKET_SCAN_WORKERS", 16),
 		BucketScanQueue:    envInt("BUCKET_SCAN_QUEUE", 65536),
 		BucketScanDO:       envBool("BUCKET_SCAN_DO", false),
+		BucketScanWordlist: envBool("BUCKET_SCAN_WORDLIST", false),
 		MetricsAddr:        envString("METRICS_ADDR", ":9090"),
 		UIUser:             envString("UI_USER", ""),
 		UIPass:             envString("UI_PASS", ""),