feat: first fully successful run e2e on straper

1 files changed, 54 insertions, 0 deletions

diff --git a/straper/db/README.md b/straper/db/README.md
new file mode 100644
index 0000000..eaf8527
--- /dev/null
+++ b/straper/db/README.md
@@ -0,0 +1,54 @@
+# sanctum — full state database
+
+| | |
+|---|---|
+| **Host** | sanctum |
+| **OS** | Debian GNU/Linux 13 (trixie) |
+| **Kernel** | 6.12.73+deb13-amd64 |
+| **Captured** | 2026-03-20T16:27:47 |
+
+## Structure
+
+```
+db/
+├── public/         Safe inventory — no secret values, git-trackable
+└── secret/
+    ├── <category>/     Secret files in plain subdirectories
+    └── secrets.index   Index of what is inside (no values)
+```
+
+## Decrypt secrets
+
+```bash
+# List contents without extracting
+  find /srv/sanctum-rebuild/db/secret -type f | sort
+
+# Extract to a directory
+mkdir /tmp/secrets-out
+  sudo cat /srv/sanctum-rebuild/db/secret/wireguard/etc-wireguard/wg0.conf
+
+# Wipe after use
+find /tmp/secrets-out -type f -exec shred -u {} \;
+rm -rf /tmp/secrets-out
+```
+
+## What is in the secret archive
+
+See `db/secret/secrets.index` for a full list.
+
+Key items:
+- WireGuard private + preshared keys
+- TLS private keys (Let's Encrypt)
+- SSH host keys + user SSH keys
+- GPG secret keyrings (all users)
+- Docker .env files and full unredacted compose files
+- MariaDB credentials + schema dumps
+- i2pd destination private keys
+- Tor hidden service private keys
+- LUKS header backups
+- Lufi app secret, Grafana credentials, Alloy tokens
+- Postfix SASL credentials
+- nginx htpasswd files
+
+## Warnings during capture
+None