diff options
| author | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
| commit | 83f7fe4b8402bab171d110703a1b1115efbc9b28 (patch) | |
| tree | 19110702c7d740f6bd8ee4f5d2ebcb97442be237 /straper/db/README.md | |
| parent | 51d43498b07dc97d795947964534f0903cd05db5 (diff) | |
| download | bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.tar.gz bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.zip | |
cleaned up many scrits and deleted some that were of no use; renamed a lot
Diffstat (limited to 'straper/db/README.md')
| -rw-r--r-- | straper/db/README.md | 54 |
1 files changed, 0 insertions, 54 deletions
diff --git a/straper/db/README.md b/straper/db/README.md deleted file mode 100644 index eaf8527..0000000 --- a/straper/db/README.md +++ /dev/null @@ -1,54 +0,0 @@ -# sanctum — full state database - -| | | -|---|---| -| **Host** | sanctum | -| **OS** | Debian GNU/Linux 13 (trixie) | -| **Kernel** | 6.12.73+deb13-amd64 | -| **Captured** | 2026-03-20T16:27:47 | - -## Structure - -``` -db/ -├── public/ Safe inventory — no secret values, git-trackable -└── secret/ - ├── <category>/ Secret files in plain subdirectories - └── secrets.index Index of what is inside (no values) -``` - -## Decrypt secrets - -```bash -# List contents without extracting - find /srv/sanctum-rebuild/db/secret -type f | sort - -# Extract to a directory -mkdir /tmp/secrets-out - sudo cat /srv/sanctum-rebuild/db/secret/wireguard/etc-wireguard/wg0.conf - -# Wipe after use -find /tmp/secrets-out -type f -exec shred -u {} \; -rm -rf /tmp/secrets-out -``` - -## What is in the secret archive - -See `db/secret/secrets.index` for a full list. - -Key items: -- WireGuard private + preshared keys -- TLS private keys (Let's Encrypt) -- SSH host keys + user SSH keys -- GPG secret keyrings (all users) -- Docker .env files and full unredacted compose files -- MariaDB credentials + schema dumps -- i2pd destination private keys -- Tor hidden service private keys -- LUKS header backups -- Lufi app secret, Grafana credentials, Alloy tokens -- Postfix SASL credentials -- nginx htpasswd files - -## Warnings during capture -None |