feat: first fully successful run e2e on straper

2 files changed, 981 insertions, 1 deletions

diff --git a/straper/lib/capture-full.sh b/straper/lib/capture-full.sh
new file mode 100644
index 0000000..e466a88
--- /dev/null
+++ b/straper/lib/capture-full.sh
@@ -0,0 +1,980 @@
+#!/usr/bin/env bash
+# =============================================================================
+# capture-full.sh — sanctum full-state capture with encrypted secret database
+# =============================================================================
+# Captures the complete state of sanctum into two tiers:
+#
+#   db/public/    — safe, unencrypted inventory (same as capture-state.sh)
+#   db/secret/    — ALL secrets, root-only (chmod 700), never committed to git
+#
+# Together these two tiers contain everything needed to fully reproduce
+# this machine on a fresh Debian 13 minimal install via bootstrap.sh.
+#
+# USAGE
+#   sudo ./capture-full.sh [--dry-run] [--help]
+#
+# OPTIONS
+#   --dry-run    Show what would be captured without writing anything
+#   --help       Show this message
+#
+# REQUIREMENTS
+#   - Must be run as root (sudo)
+#   - GPG must be installed: apt install gnupg
+#   - GPG_RECIPIENT must be set (key fingerprint or email), OR
+#     set it in /etc/labunix/capture.conf or ~/.config/labunix/capture.conf
+#   - jq must be installed: apt install jq
+#   - Output goes to CAPTURE_DIR (default: <toolkit-dir>/db/)
+#
+# OUTPUT STRUCTURE
+#   <toolkit-dir>/db/
+#   ├── capture-full.sh         this script (self-referential copy)
+#   ├── bootstrap.sh            reproduction script (generated separately)
+#   ├── db/
+#   │   ├── public/             unencrypted inventory — git-safe
+#   │   │   ├── system/
+#   │   │   ├── packages/
+#   │   │   ├── services/
+#   │   │   ├── docker/
+#   │   │   ├── network/
+#   │   │   ├── firewall/
+#   │   │   └── ...
+#   │   ├── secret/             GPG-encrypted — NEVER commit to git
+#   │   │   ├── secrets.tar.gpg all secret material in one encrypted archive
+#   │   │   └── secrets.index   unencrypted index of what is inside (no values)
+#   │   └── README.md
+#   └── README.md
+#
+# SECURITY MODEL
+#   - db/public/  : safe to push to private git repo
+#   - db/secret/  : local only, root-only permissions (chmod 700)
+#                     protected by ZFS-on-LUKS disk encryption
+#   - The .gitignore in the toolkit dir excludes db/secret/ entirely
+#   - bootstrap.sh reads db/public/ for structure and db/secret/ for values
+# =============================================================================
+
+set -euo pipefail
+
+# --------------------------------------------------------------------------- #
+#  CONFIGURATION
+# --------------------------------------------------------------------------- #
+SCRIPT_DIR="$(cd -- "$(dirname -- "$0")" && pwd)"
+CAPTURE_DIR="${CAPTURE_DIR:-${SCRIPT_DIR}}"
+PUBLIC_DIR="${CAPTURE_DIR}/db/public"
+SECRET_DIR="${CAPTURE_DIR}/db/secret"
+TIMESTAMP="$(date +"%Y-%m-%dT%H:%M:%S")"
+HOSTNAME_SHORT="$(hostname -s)"
+DRY_RUN=false
+WARNINGS=()
+
+# Load config file if present
+for conf in /etc/labunix/capture.conf "${HOME}/.config/labunix/capture.conf"; do
+  [[ -f "$conf" ]] && source "$conf" || true
+done
+
+# --------------------------------------------------------------------------- #
+#  ARGUMENT PARSING
+# --------------------------------------------------------------------------- #
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) DRY_RUN=true ;;
+    --help)
+      grep '^#' "$0" | head -40 | sed 's/^# \?//'
+      exit 0
+      ;;
+    *) echo "Unknown option: $arg" >&2; exit 1 ;;
+  esac
+done
+
+# --------------------------------------------------------------------------- #
+#  HELPERS
+# --------------------------------------------------------------------------- #
+log()     { echo "  [$(date +%H:%M:%S)] $*"; }
+warn()    { echo "  [$(date +%H:%M:%S)] WARN: $*" >&2; WARNINGS+=("$*"); }
+section() { echo ""; echo "── $* ──"; }
+die()     { echo "ERROR: $*" >&2; exit 1; }
+
+# pub <outfile> <cmd...>
+# Capture command output into public (unencrypted) tier.
+pub() {
+  local out="${PUBLIC_DIR}/$1"; shift
+  if $DRY_RUN; then echo "  [pub] $* → ${out#$PUBLIC_DIR/}"; return; fi
+  mkdir -p "$(dirname "$out")"
+  if ! "$@" > "$out" 2>&1; then
+    warn "command failed: $*"
+    echo "# ERROR: '$*' failed at ${TIMESTAMP}" > "$out"
+  fi
+}
+
+# pub_copy <src> <dst_relative>
+# Copy file/dir into public tier.
+pub_copy() {
+  local src="$1" dst="${PUBLIC_DIR}/$2"
+  if $DRY_RUN; then echo "  [pub] copy ${src} → $2"; return; fi
+  [[ -e "$src" ]] || return 0
+  mkdir -p "$(dirname "$dst")"
+  cp -a "$src" "$dst" 2>/dev/null || warn "could not copy ${src}"
+}
+
+# sec <dst_relative> <src_path>
+# Copy secret material directly into the secret directory.
+sec() {
+  local dst="${SECRET_DIR}/$1" src="$2"
+  if $DRY_RUN; then echo "  [sec] ${src} → secret/$1"; return; fi
+  [[ -e "$src" ]] || return 0
+  mkdir -p "$(dirname "$dst")"
+  cp -a "$src" "$dst" 2>/dev/null || warn "could not stage secret: ${src}"
+}
+
+# sec_val <dst_relative> <value>
+# Write a literal secret value as a file.
+sec_val() {
+  local dst="${SECRET_DIR}/$1"
+  if $DRY_RUN; then echo "  [sec] value → secret/$1"; return; fi
+  mkdir -p "$(dirname "$dst")"
+  printf '%s\n' "$2" > "$dst"
+}
+
+# sec_cmd <dst_relative> <cmd...>
+# Capture command output as a secret.
+sec_cmd() {
+  local dst="${SECRET_DIR}/$1"; shift
+  if $DRY_RUN; then echo "  [sec] command → secret/$1"; return; fi
+  mkdir -p "$(dirname "$dst")"
+  if ! "$@" > "$dst" 2>&1; then
+    warn "secret command failed: $*"
+    echo "# ERROR: '$*' failed" > "$dst"
+  fi
+}
+
+# index_secret <path> <description>
+# Add an entry to the secrets index (unencrypted — shows what exists, not values).
+SECRET_INDEX_ENTRIES=()
+index_secret() {
+  SECRET_INDEX_ENTRIES+=("$(printf '%-50s  %s' "$1" "$2")")
+}
+
+# --------------------------------------------------------------------------- #
+#  PRE-FLIGHT CHECKS
+# --------------------------------------------------------------------------- #
+[[ $EUID -eq 0 ]] || die "run with sudo"
+
+if ! $DRY_RUN; then
+  command -v jq  &>/dev/null || die "jq not found — apt install jq"
+  command -v tar &>/dev/null || die "tar not found"
+
+  mkdir -p "${PUBLIC_DIR}" "${SECRET_DIR}"
+  chmod 700 "${SECRET_DIR}"
+fi
+
+echo ""
+echo "╔══════════════════════════════════════════════════════╗"
+echo "║  labunix · capture-full — full state + secret DB    ║"
+echo "╚══════════════════════════════════════════════════════╝"
+echo ""
+log "host      : ${HOSTNAME_SHORT}"
+log "timestamp : ${TIMESTAMP}"
+log "public    : ${PUBLIC_DIR}"
+log "secret    : ${SECRET_DIR}/ (root-only, chmod 700)"
+$DRY_RUN && log "(DRY RUN — nothing will be written)"
+
+# =========================================================================== #
+#  PUBLIC TIER — safe inventory, no secret values
+# =========================================================================== #
+
+# --------------------------------------------------------------------------- #
+#  P1. SYSTEM IDENTITY
+# --------------------------------------------------------------------------- #
+section "P1 system"
+
+pub "system/hostname.txt"    hostname -f
+pub "system/os-release.txt"  cat /etc/os-release
+pub "system/kernel.txt"      uname -a
+pub "system/lscpu.txt"       lscpu
+pub "system/memory.txt"      free -h
+pub "system/lsblk.txt"       lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,UUID,LABEL
+pub "system/df.txt"          df -hT --exclude-type=tmpfs --exclude-type=devtmpfs
+pub "system/locale.txt"      locale
+pub "system/timedatectl.txt" timedatectl
+pub "system/uptime.txt"      uptime
+pub "system/dmesg-err.txt"   dmesg --level=err,crit,alert,emerg
+
+pub_copy /etc/hostname    "system/etc-hostname"
+pub_copy /etc/hosts       "system/etc-hosts"
+pub_copy /etc/fstab       "system/etc-fstab"
+pub_copy /etc/crypttab    "system/etc-crypttab"
+pub_copy /etc/environment "system/etc-environment"
+pub_copy /etc/locale.gen  "system/locale.gen"
+pub_copy /etc/timezone    "system/timezone"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P2. ZFS
+# --------------------------------------------------------------------------- #
+section "P2 zfs"
+
+if command -v zpool &>/dev/null; then
+  pub "zfs/zpool-status.txt"   zpool status -v
+  pub "zfs/zpool-list.txt"     zpool list -v
+  pub "zfs/zpool-history.txt"  zpool history
+  pub "zfs/zfs-list.txt"       zfs list -t all -o name,used,avail,refer,mountpoint,type
+  pub "zfs/zfs-properties.txt" zfs get all
+  pub "zfs/zfs-snapshots.txt"  zfs list -t snapshot -o name,used,creation -s creation
+  pub_copy /etc/zfs            "zfs/etc-zfs"
+  log "done"
+else
+  warn "zpool not found — skipping ZFS"
+fi
+
+# --------------------------------------------------------------------------- #
+#  P3. NETWORK
+# --------------------------------------------------------------------------- #
+section "P3 network"
+
+pub "network/ip-addr.txt"      ip -s addr show
+pub "network/ip-route.txt"     ip route show table all
+pub "network/ip-rule.txt"      ip rule show
+pub "network/ss-listening.txt" ss -tlnpue
+
+pub_copy /etc/network         "network/etc-network"
+pub_copy /etc/netplan         "network/etc-netplan"
+pub_copy /etc/systemd/network "network/systemd-network"
+pub_copy /etc/nsswitch.conf   "network/nsswitch.conf"
+pub_copy /etc/hosts.allow     "network/hosts.allow"
+pub_copy /etc/hosts.deny      "network/hosts.deny"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P4. FIREWALL
+# --------------------------------------------------------------------------- #
+section "P4 firewall"
+
+pub "firewall/nft-ruleset.txt"  nft list ruleset
+pub "firewall/nft-ruleset.json" nft -j list ruleset
+
+pub_copy /etc/nftables.conf "firewall/nftables.conf"
+pub_copy /etc/nftables.d    "firewall/nftables.d"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P5. WIREGUARD — public info only
+# --------------------------------------------------------------------------- #
+section "P5 wireguard"
+
+if command -v wg &>/dev/null; then
+  pub "wireguard/wg-show.txt"       wg show
+  pub "wireguard/wg-interfaces.txt" ip link show type wireguard
+
+  # Redacted public copy (PrivateKey + PresharedKey scrubbed)
+  if ! $DRY_RUN && [[ -d /etc/wireguard ]]; then
+    mkdir -p "${PUBLIC_DIR}/wireguard/etc-wireguard"
+    for f in /etc/wireguard/*.conf; do
+      [[ -f "$f" ]] || continue
+      base="$(basename "$f")"
+      sed \
+        -e 's/^\(PrivateKey\s*=\s*\).*/\1<REDACTED>/' \
+        -e 's/^\(PresharedKey\s*=\s*\).*/\1<REDACTED>/' \
+        "$f" > "${PUBLIC_DIR}/wireguard/etc-wireguard/${base}" 2>/dev/null \
+        || warn "could not sanitize ${f}"
+    done
+    log "public: PrivateKey + PresharedKey redacted"
+  fi
+  log "done"
+else
+  warn "wg not found — skipping WireGuard"
+fi
+
+# --------------------------------------------------------------------------- #
+#  P6. DNS
+# --------------------------------------------------------------------------- #
+section "P6 dns"
+
+if [[ -f /etc/dnsmasq.conf ]] || command -v dnsmasq &>/dev/null; then
+  command -v dnsmasq &>/dev/null && pub "dns/dnsmasq-version.txt" dnsmasq --version
+  pub_copy /etc/dnsmasq.conf "dns/dnsmasq.conf"
+  pub_copy /etc/dnsmasq.d    "dns/dnsmasq.d"
+fi
+
+if [[ -d /etc/unbound ]]; then
+  command -v unbound &>/dev/null && pub "dns/unbound-version.txt" unbound -V
+  pub_copy /etc/unbound "dns/etc-unbound"
+fi
+
+pub_copy /etc/resolv.conf "dns/resolv.conf"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P7. TLS — cert metadata only (no key material)
+# --------------------------------------------------------------------------- #
+section "P7 tls"
+
+if command -v certbot &>/dev/null; then
+  pub "tls/certbot-version.txt"      certbot --version
+  pub "tls/certbot-certificates.txt" certbot certificates
+fi
+
+pub_copy /etc/letsencrypt/renewal "tls/renewal-configs"
+pub_copy /etc/letsencrypt/cli.ini "tls/cli.ini"
+
+# Cert expiry summary
+if ! $DRY_RUN && [[ -d /etc/letsencrypt/live ]]; then
+  {
+    printf "# TLS certificate expiry — %s\n" "${TIMESTAMP}"
+    printf "# %-40s  %-28s  %-28s  %s\n" "domain" "not_before" "not_after" "days_left"
+    echo ""
+    for cert in /etc/letsencrypt/live/*/fullchain.pem; do
+      [[ -f "$cert" ]] || continue
+      domain="$(basename "$(dirname "$cert")")"
+      not_before="$(openssl x509 -noout -startdate -in "$cert" 2>/dev/null | cut -d= -f2)"
+      not_after="$(openssl x509  -noout -enddate   -in "$cert" 2>/dev/null | cut -d= -f2)"
+      expiry_epoch="$(date -d "$not_after" +%s 2>/dev/null || echo 0)"
+      days_left=$(( (expiry_epoch - $(date +%s)) / 86400 ))
+      printf "%-42s  %-28s  %-28s  %d\n" \
+        "$domain" "$not_before" "$not_after" "$days_left"
+    done
+  } > "${PUBLIC_DIR}/tls/cert-expiry.txt"
+fi
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P8. NGINX — config (may reference secrets but config itself is public)
+# --------------------------------------------------------------------------- #
+section "P8 nginx"
+
+if command -v nginx &>/dev/null; then
+  pub "nginx/nginx-version.txt" nginx -v
+  pub "nginx/nginx-T.txt"       nginx -T
+  pub "nginx/nginx-t.txt"       nginx -t
+  pub_copy /etc/nginx           "nginx/etc-nginx"
+
+  if ! $DRY_RUN; then
+    # Remove auth files from the public copy
+    find "${PUBLIC_DIR}/nginx/etc-nginx" \
+      \( -name "*.htpasswd" -o -name "htpasswd-*" -o -name ".htpasswd" -o -name "lufi.htpasswd" \) \
+      -delete 2>/dev/null || true
+
+    # Remove local backup trees from the public copy
+    find "${PUBLIC_DIR}/nginx/etc-nginx" \
+      -maxdepth 1 -type d -name 'sites-available.bak.*' \
+      -exec rm -rf {} + 2>/dev/null || true
+
+    log "htpasswd files removed from public nginx copy"
+    log "nginx backup dirs removed from public copy"
+  fi
+
+  log "done"
+else
+  warn "nginx not found"
+fi
+
+# --------------------------------------------------------------------------- #
+#  P9. DOCKER — sanitized inventory
+# --------------------------------------------------------------------------- #
+section "P9 docker"
+
+if command -v docker &>/dev/null; then
+  pub "docker/docker-version.txt"    docker version
+  pub "docker/docker-info.txt"       docker info
+  pub "docker/docker-ps.txt"         docker ps -a \
+    --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"
+  pub "docker/docker-images.txt"     docker images \
+    --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}\t{{.CreatedAt}}"
+  pub "docker/docker-volumes.txt"    docker volume ls
+  pub "docker/docker-networks.txt"   docker network ls \
+    --format "table {{.Name}}\t{{.Driver}}\t{{.Scope}}\t{{.ID}}"
+  pub "docker/docker-compose-ls.txt" docker compose ls 2>/dev/null || true
+  pub_copy /etc/docker/daemon.json   "docker/daemon.json"
+
+  # Inspect with Env[] stripped
+  if ! $DRY_RUN && command -v jq &>/dev/null; then
+    mkdir -p "${PUBLIC_DIR}/docker/inspect"
+    docker ps -aq 2>/dev/null | while read -r cid; do
+      name="$(docker inspect --format '{{.Name}}' "$cid" \
+              | tr '/' '_' | sed 's/^_//')"
+      docker inspect "$cid" 2>/dev/null \
+        | jq '.[0] | del(.Config.Env, .HostConfig.Env)' \
+        > "${PUBLIC_DIR}/docker/inspect/${name}.json" 2>/dev/null || true
+    done
+    log "inspect captured (Env[] stripped)"
+  fi
+
+  # Compose files — redact secret-looking values
+  if ! $DRY_RUN; then
+    mkdir -p "${PUBLIC_DIR}/docker/compose-redacted"
+    find /srv /opt /home /root -maxdepth 3 \
+      \( -name "docker-compose.yml" -o -name "docker-compose.yaml" \
+         -o -name "compose.yml"     -o -name "compose.yaml" \) \
+      -not -path "*/sanctum-rebuild/*" \
+      -not -path "*/labunix-infra/*" \
+      -not -path "*/\.*" \
+      2>/dev/null \
+      | while read -r f; do
+          rel="$(echo "$f" | sed 's|^/||; s|/|__|g')"
+          sed -E \
+            -e 's/(PASSWORD|SECRET|TOKEN|API_KEY|APIKEY|AUTH_KEY|PRIVATE_KEY|DB_PASS|MYSQL_PASS|POSTGRES_PASS|REDIS_PASS|SMTP_PASS)[[:space:]]*=[[:space:]]*[^[:space:]#].*/\1=<REDACTED>/gI' \
+            -e 's/(PASSWORD|SECRET|TOKEN|API_KEY|APIKEY|AUTH_KEY|PRIVATE_KEY|DB_PASS|MYSQL_PASS|POSTGRES_PASS|REDIS_PASS|SMTP_PASS):[[:space:]]*"[^"]*"/\1: "<REDACTED>"/gI' \
+            "$f" > "${PUBLIC_DIR}/docker/compose-redacted/${rel}" 2>/dev/null || true
+        done
+    log "compose files collected (secrets redacted)"
+  fi
+
+  log "done"
+else
+  warn "docker not found"
+fi
+
+# --------------------------------------------------------------------------- #
+#  P10. PACKAGES
+# --------------------------------------------------------------------------- #
+section "P10 packages"
+
+pub "packages/dpkg-list.txt"       dpkg -l
+pub "packages/dpkg-selections.txt" dpkg --get-selections
+pub "packages/apt-mark-manual.txt" apt-mark showmanual
+pub "packages/apt-mark-auto.txt"   apt-mark showauto
+
+pub_copy /etc/apt/sources.list   "packages/apt/sources.list"
+pub_copy /etc/apt/sources.list.d "packages/apt/sources.list.d"
+pub_copy /etc/apt/preferences    "packages/apt/preferences"
+pub_copy /etc/apt/preferences.d  "packages/apt/preferences.d"
+pub_copy /etc/apt/apt.conf.d     "packages/apt/apt.conf.d"
+
+command -v pip3    &>/dev/null && pub "packages/pip3-list.txt"    pip3 list --format=columns
+command -v npm     &>/dev/null && pub "packages/npm-global.txt"   npm list -g --depth=0
+command -v cargo   &>/dev/null && pub "packages/cargo-list.txt"   cargo install --list
+command -v gem     &>/dev/null && pub "packages/gem-list.txt"     gem list
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P11. SYSTEMD SERVICES
+# --------------------------------------------------------------------------- #
+section "P11 services"
+
+pub "services/units-enabled.txt"  systemctl list-unit-files --state=enabled  --no-pager
+pub "services/units-running.txt"  systemctl list-units --type=service --state=running --no-pager
+pub "services/units-failed.txt"   systemctl list-units --state=failed --no-pager
+pub "services/timers.txt"         systemctl list-timers --all --no-pager
+pub "services/unit-files-all.txt" systemctl list-unit-files --no-pager
+
+if ! $DRY_RUN; then
+  mkdir -p "${PUBLIC_DIR}/services/custom-units"
+  for f in /etc/systemd/system/*.service \
+            /etc/systemd/system/*.timer   \
+            /etc/systemd/system/*.socket  \
+            /etc/systemd/system/*.mount   \
+            /etc/systemd/system/*.target  \
+            /etc/systemd/system/*.path; do
+    [[ -f "$f" ]] || continue
+    cp "$f" "${PUBLIC_DIR}/services/custom-units/" 2>/dev/null || true
+  done
+  for d in /etc/systemd/system/*.d; do
+    [[ -d "$d" ]] || continue
+    cp -a "$d" "${PUBLIC_DIR}/services/custom-units/" 2>/dev/null || true
+  done
+  log "custom units + drop-ins copied"
+fi
+
+pub_copy /etc/systemd/journald.conf  "services/journald.conf"
+pub_copy /etc/systemd/logind.conf    "services/logind.conf"
+pub_copy /etc/systemd/system.conf    "services/system.conf"
+pub_copy /etc/systemd/timesyncd.conf "services/timesyncd.conf"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P12. CRON
+# --------------------------------------------------------------------------- #
+section "P12 cron"
+
+pub_copy /etc/crontab           "cron/crontab"
+pub_copy /etc/cron.d            "cron/cron.d"
+pub_copy /etc/cron.daily        "cron/cron.daily"
+pub_copy /etc/cron.weekly       "cron/cron.weekly"
+pub_copy /etc/cron.monthly      "cron/cron.monthly"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P13. USERS — sanitized (no hashes)
+# --------------------------------------------------------------------------- #
+section "P13 users"
+
+if ! $DRY_RUN; then
+  mkdir -p "${PUBLIC_DIR}/users"
+  awk -F: '{print $1":"$3":"$4":"$5":"$6":"$7}' /etc/passwd \
+    > "${PUBLIC_DIR}/users/passwd-sanitized.txt" 2>/dev/null || true
+  awk -F: '{print $1":"$3}' /etc/group \
+    > "${PUBLIC_DIR}/users/groups-sanitized.txt" 2>/dev/null || true
+  grep -E '(/bin/bash|/bin/zsh|/bin/sh|/usr/bin/zsh)$' /etc/passwd \
+    | awk -F: '{print $1" home="$6" shell="$7}' \
+    > "${PUBLIC_DIR}/users/login-users.txt" 2>/dev/null || true
+fi
+
+pub_copy /etc/ssh/sshd_config   "users/sshd_config"
+pub_copy /etc/ssh/sshd_config.d "users/sshd_config.d"
+pub_copy /etc/sudoers           "users/sudoers"
+pub_copy /etc/sudoers.d         "users/sudoers.d"
+pub_copy /etc/shells            "users/shells"
+pub_copy /etc/login.defs        "users/login.defs"
+
+log "done"
+
+# --------------------------------------------------------------------------- #
+#  P14–P35: remaining public captures (configs without embedded secrets)
+# --------------------------------------------------------------------------- #
+section "P14-P35 service configs"
+
+# Kernel
+pub "kernel/sysctl-all.txt" sysctl -a
+pub "kernel/lsmod.txt"      lsmod
+pub_copy /etc/sysctl.conf    "kernel/sysctl.conf"
+pub_copy /etc/sysctl.d       "kernel/sysctl.d"
+pub_copy /etc/modules        "kernel/modules"
+pub_copy /etc/modules-load.d "kernel/modules-load.d"
+pub_copy /etc/modprobe.d     "kernel/modprobe.d"
+
+# i2pd (no key material)
+if [[ -f /etc/i2pd/i2pd.conf ]]; then
+  pub_copy /etc/i2pd "i2pd/etc-i2pd"
+fi
+
+# Tor (no private keys)
+if [[ -f /etc/tor/torrc ]]; then
+  pub_copy /etc/tor/torrc   "tor/torrc"
+  pub_copy /etc/tor/torrc.d "tor/torrc.d"
+  if ! $DRY_RUN && [[ -d /var/lib/tor ]]; then
+    mkdir -p "${PUBLIC_DIR}/tor/hidden-services"
+    find /var/lib/tor -name "hostname" 2>/dev/null \
+      | while read -r hf; do
+          svc="$(basename "$(dirname "$hf")")"
+          cp "$hf" "${PUBLIC_DIR}/tor/hidden-services/${svc}.hostname" 2>/dev/null || true
+        done
+  fi
+fi
+
+# Hugo
+command -v hugo &>/dev/null && pub "hugo/hugo-version.txt" hugo version
+for site_dir in /srv/www/labunix /srv/www/labunix.xyz; do
+  [[ -d "$site_dir" ]] || continue
+  pub_copy "${site_dir}/hugo.toml"  "hugo/hugo.toml"
+  pub_copy "${site_dir}/config"     "hugo/config-dir"
+  pub_copy "${site_dir}/go.mod"     "hugo/go.mod"
+  break
+done
+
+# Agate
+if [[ -f /home/lukasz/apps/agate/agate ]]; then
+  pub "agate/agate-version.txt" /home/lukasz/apps/agate/agate --version
+  if ! $DRY_RUN && [[ -d /srv/gemini-capsule ]]; then
+    find /srv/gemini-capsule -not -path "*/.certificates*" \
+      | sort > "${PUBLIC_DIR}/agate/capsule-structure.txt" 2>/dev/null || true
+  fi
+fi
+
+# Pygopherd
+pub_copy /etc/pygopherd "pygopherd/etc-pygopherd"
+
+# Agate service unit
+pub_copy /etc/systemd/system/agate.service "agate/agate.service"
+
+# Postfix (main.cf is public, sasl_passwd goes to secret)
+if [[ -d /etc/postfix ]]; then
+  pub_copy /etc/postfix/main.cf   "postfix/main.cf"
+  pub_copy /etc/postfix/master.cf "postfix/master.cf"
+  pub "postfix/postconf.txt" postconf 2>/dev/null || true
+fi
+
+# MariaDB (config only, no credentials)
+pub_copy /etc/mysql "mariadb/etc-mysql"
+if ! $DRY_RUN; then
+  mariadb --defaults-file=/etc/mysql/debian.cnf \
+    -e "SHOW DATABASES;" 2>/dev/null \
+    > "${PUBLIC_DIR}/mariadb/databases.txt" || true
+fi
+
+# Alloy
+pub_copy /etc/alloy         "alloy/etc-alloy"
+pub_copy /etc/default/alloy "alloy/etc-default-alloy"
+
+# Prometheus
+pub_copy /etc/prometheus "prometheus/etc-prometheus"
+pub_copy /etc/default/prometheus-node-exporter "prometheus/node-exporter-defaults"
+
+# Fail2ban
+pub_copy /etc/fail2ban "fail2ban/etc-fail2ban"
+
+# Prosody
+pub_copy /etc/prosody "prosody/etc-prosody"
+
+# Grafana (provisioning configs, no secrets)
+pub_copy /etc/grafana "grafana/etc-grafana"
+
+# Loki + Promtail
+pub_copy /etc/loki    "loki/etc-loki"
+pub_copy /etc/promtail "loki/etc-promtail"
+
+# Mumble
+pub_copy /etc/mumble "mumble/etc-mumble"
+
+# AppArmor
+command -v aa-status &>/dev/null \
+  && pub "apparmor/aa-status.txt" aa-status 2>/dev/null || true
+pub_copy /etc/apparmor.d "apparmor/apparmor.d"
+
+# Boot / initramfs — critical for LUKS+ZFS rebuild
+pub_copy /etc/default/grub         "boot/grub-default"
+pub_copy /etc/grub.d               "boot/grub.d"
+pub_copy /etc/kernel               "boot/etc-kernel"
+pub_copy /etc/cryptsetup-initramfs "boot/cryptsetup-initramfs"
+pub_copy /etc/initramfs-tools      "boot/initramfs-tools"
+pub_copy /etc/default              "boot/etc-default"
+
+# Lufi
+pub_copy /srv/lufi/cpanfile "lufi/cpanfile"
+if ! $DRY_RUN && [[ -d /srv/lufi ]]; then
+  git -C /srv/lufi log --oneline -5 2>/dev/null \
+    > "${PUBLIC_DIR}/lufi/git-log.txt" || true
+fi
+
+# Environment
+pub_copy /etc/profile   "environment/profile"
+pub_copy /etc/profile.d "environment/profile.d"
+pub_copy /etc/zsh       "environment/zsh"
+
+# Logging
+pub_copy /etc/logrotate.conf "logging/logrotate.conf"
+pub_copy /etc/logrotate.d    "logging/logrotate.d"
+pub_copy /etc/rsyslog.conf   "logging/rsyslog.conf"
+pub_copy /etc/rsyslog.d      "logging/rsyslog.d"
+
+# Hardware
+command -v lshw  &>/dev/null && pub "hardware/lshw.txt"  lshw -short
+command -v lspci &>/dev/null && pub "hardware/lspci.txt" lspci -v
+command -v lsusb &>/dev/null && pub "hardware/lsusb.txt" lsusb
+pub "hardware/cpuinfo.txt"   cat /proc/cpuinfo
+pub "hardware/meminfo.txt"   cat /proc/meminfo
+
+log "done"
+
+# =========================================================================== #
+#  SECRET TIER — full secrets, will be GPG-encrypted
+# =========================================================================== #
+
+section "SECRET TIER"
+log "Staging secret material..."
+
+# ── WireGuard — real private keys ───────────────────────────────────────────
+if [[ -d /etc/wireguard ]]; then
+  sec "wireguard/etc-wireguard" /etc/wireguard
+  index_secret "wireguard/etc-wireguard" "WireGuard interface configs with PrivateKey + PresharedKey"
+fi
+
+# ── TLS private keys ─────────────────────────────────────────────────────────
+if [[ -d /etc/letsencrypt ]]; then
+  sec "tls/letsencrypt" /etc/letsencrypt
+  index_secret "tls/letsencrypt" "Full Let's Encrypt dir including private keys"
+fi
+
+# ── SSH host keys ────────────────────────────────────────────────────────────
+if [[ -d /etc/ssh ]]; then
+  sec "ssh/etc-ssh" /etc/ssh
+  index_secret "ssh/etc-ssh" "SSH host keys (id_* private key files)"
+fi
+
+# ── User SSH keys + authorized_keys ─────────────────────────────────────────
+if ! $DRY_RUN; then
+  while IFS=: read -r user _ _ _ _ homedir _; do
+    [[ -d "${homedir}/.ssh" ]] || continue
+    sec "ssh/user-${user}" "${homedir}/.ssh"
+    index_secret "ssh/user-${user}" "SSH keys and authorized_keys for ${user}"
+  done < /etc/passwd
+fi
+
+# ── Docker compose files — full unredacted ──────────────────────────────────
+if ! $DRY_RUN; then
+  mkdir -p "${SECRET_DIR}/docker/compose-full"
+  find /srv /opt /home /root -maxdepth 3 \
+    \( -name "docker-compose.yml" -o -name "docker-compose.yaml" \
+       -o -name "compose.yml"     -o -name "compose.yaml" \
+       -o -name ".env"            -o -name "*.env" \) \
+    -not -path "*/sanctum-rebuild/*" \
+    -not -path "*/labunix-infra/*" \
+    -not -path "*/\.*env.example" \
+    2>/dev/null \
+    | while read -r f; do
+        rel="$(echo "$f" | sed 's|^/||; s|/|__|g')"
+        cp "$f" "${SECRET_DIR}/docker/compose-full/${rel}" 2>/dev/null || true
+      done
+  index_secret "docker/compose-full" "All compose files + .env files with real secrets"
+fi
+
+# ── MariaDB credentials + dumps ──────────────────────────────────────────────
+if [[ -f /etc/mysql/debian.cnf ]]; then
+  sec "mariadb/debian.cnf" /etc/mysql/debian.cnf
+  index_secret "mariadb/debian.cnf" "MariaDB debian-sys-maint credentials"
+fi
+
+# Dump all database schemas (structure only, no data) — for rebuild reference
+if ! $DRY_RUN && command -v mysqldump &>/dev/null; then
+  mkdir -p "${SECRET_DIR}/mariadb"
+  mariadb --defaults-file=/etc/mysql/debian.cnf \
+    -e "SHOW DATABASES;" 2>/dev/null \
+    | grep -v "^Database\|information_schema\|performance_schema\|sys" \
+    | while read -r db; do
+        mysqldump --defaults-file=/etc/mysql/debian.cnf \
+          --no-data --routines --triggers \
+          "$db" 2>/dev/null \
+          > "${SECRET_DIR}/mariadb/schema-${db}.sql" || true
+      done
+  index_secret "mariadb/schema-*.sql" "MariaDB schema dumps (structure only, no data)"
+fi
+
+# ── Postfix SASL credentials ─────────────────────────────────────────────────
+if [[ -f /etc/postfix/sasl_passwd ]]; then
+  sec "postfix/sasl_passwd" /etc/postfix/sasl_passwd
+  index_secret "postfix/sasl_passwd" "Postfix SASL relay credentials"
+fi
+
+# ── GPG keys (export secret keyring) ────────────────────────────────────────
+if ! $DRY_RUN && command -v gpg &>/dev/null; then
+  mkdir -p "${SECRET_DIR}/gpg"
+  # Export all secret keys for all users with home dirs
+  while IFS=: read -r user _ _ _ _ homedir _; do
+    [[ -d "${homedir}/.gnupg" ]] || continue
+    # Run gpg as the actual user, not as root, so it can access their keyring
+    sudo -u "${user}"       GNUPGHOME="${homedir}/.gnupg" gpg       --batch --yes       --export-secret-keys --armor       > "${SECRET_DIR}/gpg/${user}-secret-keys.asc" 2>/dev/null || true
+    sudo -u "${user}"       GNUPGHOME="${homedir}/.gnupg" gpg       --batch --yes       --export --armor       > "${SECRET_DIR}/gpg/${user}-public-keys.asc" 2>/dev/null || true
+    sudo -u "${user}"       GNUPGHOME="${homedir}/.gnupg" gpg       --batch --yes       --export-ownertrust       > "${SECRET_DIR}/gpg/${user}-ownertrust.txt" 2>/dev/null || true
+  done < /etc/passwd
+  index_secret "gpg/" "GPG secret + public keyrings and ownertrust for all users"
+fi
+
+# ── i2pd destination keys ────────────────────────────────────────────────────
+if [[ -d /var/lib/i2pd ]]; then
+  sec "i2pd/var-lib-i2pd" /var/lib/i2pd
+  index_secret "i2pd/var-lib-i2pd" "i2pd full data dir including destination private keys"
+fi
+
+# ── Tor hidden service keys ──────────────────────────────────────────────────
+if [[ -d /var/lib/tor ]]; then
+  sec "tor/var-lib-tor" /var/lib/tor
+  index_secret "tor/var-lib-tor" "Tor full data dir including hidden service private keys"
+fi
+
+# ── Nginx htpasswd files ─────────────────────────────────────────────────────
+if ! $DRY_RUN; then
+  mkdir -p "${SECRET_DIR}/nginx"
+  find /etc/nginx -name "*.htpasswd" -o -name "htpasswd-*" -o -name ".htpasswd" \
+    2>/dev/null \
+    | while read -r f; do
+        cp "$f" "${SECRET_DIR}/nginx/" 2>/dev/null || true
+      done
+  index_secret "nginx/" "nginx htpasswd files (bcrypt password hashes)"
+fi
+
+# ── User shell configs (may contain tokens/API keys) ────────────────────────
+for user_home in /root /home/lukasz; do
+  user="$(basename "$user_home")"
+  [[ "$user" == "root" ]] && user="root"
+  if ! $DRY_RUN; then
+    mkdir -p "${SECRET_DIR}/shell/${user}"
+    for f in .bashrc .zshrc .profile .bash_profile .zprofile \
+              .netrc .ssh/config; do
+      [[ -f "${user_home}/${f}" ]] \
+        && cp "${user_home}/${f}" \
+              "${SECRET_DIR}/shell/${user}/$(basename "$f")" 2>/dev/null || true
+    done
+  fi
+  index_secret "shell/${user}" "Shell configs for ${user} (may contain tokens/API keys)"
+done
+
+# ── Lufi app config (contains app secret + DB path) ─────────────────────────
+if [[ -f /srv/lufi/lufi.conf ]]; then
+  sec "lufi/lufi.conf" /srv/lufi/lufi.conf
+  index_secret "lufi/lufi.conf" "Lufi app config (secret key, DB path, domain)"
+fi
+
+# ── Grafana secrets ──────────────────────────────────────────────────────────
+if [[ -f /etc/grafana/grafana.ini ]]; then
+  sec "grafana/grafana.ini" /etc/grafana/grafana.ini
+  index_secret "grafana/grafana.ini" "Grafana config (admin password, secret key)"
+fi
+
+# ── Alloy config (may contain remote write credentials) ─────────────────────
+if [[ -d /etc/alloy ]]; then
+  sec "alloy/etc-alloy" /etc/alloy
+  index_secret "alloy/etc-alloy" "Grafana Alloy config (may contain remote write tokens)"
+fi
+
+# ── Borg backup passphrase / config ─────────────────────────────────────────
+if [[ -d /etc/borg ]]; then
+  sec "borg/etc-borg" /etc/borg
+  index_secret "borg/etc-borg" "Borg backup config (repo paths, passphrase)"
+fi
+for f in /root/.config/borg/config /root/.borgmatic.yaml /etc/borgmatic.d; do
+  if [[ -e "$f" ]]; then
+    sec "borg/$(basename "$f")" "$f"
+    index_secret "borg/$(basename "$f")" "Borgmatic config"
+  fi
+done
+
+# ── User crontabs (may contain tokens in commands) ──────────────────────────
+if [[ -d /var/spool/cron/crontabs ]]; then
+  sec "cron/user-crontabs" /var/spool/cron/crontabs
+  index_secret "cron/user-crontabs" "User crontabs (may contain API keys in commands)"
+fi
+
+# ── Prosody secrets (SSL certs + account data location) ─────────────────────
+if [[ -d /etc/prosody ]]; then
+  sec "prosody/etc-prosody" /etc/prosody
+  index_secret "prosody/etc-prosody" "Full Prosody config including any embedded credentials"
+fi
+
+# ── LUKS header backup ───────────────────────────────────────────────────────
+# Backing up the LUKS header is critical for recovery if the header gets corrupted
+if ! $DRY_RUN && command -v cryptsetup &>/dev/null; then
+  mkdir -p "${SECRET_DIR}/luks"
+  # Find LUKS devices
+  lsblk -o NAME,TYPE,FSTYPE -J 2>/dev/null \
+    | jq -r '.blockdevices[] | .. | objects | select(.fstype=="crypto_LUKS") | .name' \
+    2>/dev/null \
+    | while read -r dev; do
+        rm -f "${SECRET_DIR}/luks/${dev}-header.bin"
+        cryptsetup luksHeaderBackup "/dev/${dev}" \
+          --header-backup-file "${SECRET_DIR}/luks/${dev}-header.bin" \
+          2>/dev/null \
+          && log "LUKS header backup: /dev/${dev}" \
+          || warn "could not backup LUKS header for /dev/${dev}"
+      done
+  index_secret "luks/" "LUKS header backups — critical for encrypted volume recovery"
+fi
+
+log "Secret staging complete"
+
+# =========================================================================== #
+#  ENCRYPT SECRET TIER
+# =========================================================================== #
+
+section "finalise secrets"
+
+if ! $DRY_RUN; then
+  # Lock down permissions — secret dir readable only by root
+  chmod 700 "${SECRET_DIR}"
+  find "${SECRET_DIR}" -type f -exec chmod 600 {} \;
+  find "${SECRET_DIR}" -type d -exec chmod 700 {} \;
+  log "Secret dir locked: chmod 700 ${SECRET_DIR}"
+
+  log "Secret files written to ${SECRET_DIR}/"
+else
+  log "[dry] secret files would be written to ${SECRET_DIR}/ (chmod 700)"
+  log "[dry] staging area would be wiped after encryption"
+fi
+
+# =========================================================================== #
+#  WRITE .gitignore
+# =========================================================================== #
+
+if ! $DRY_RUN; then
+  cat > "${CAPTURE_DIR}/.gitignore" << 'GITIGNORE'
+# Secret tier — NEVER commit (contains private keys, credentials, LUKS headers)
+db/secret/
+
+# Exception: the index is safe to commit (shows what exists, not values)
+!db/secret/secrets.index
+GITIGNORE
+fi
+
+# =========================================================================== #
+#  WRITE db/README.md
+# =========================================================================== #
+
+if ! $DRY_RUN; then
+  OS_NAME="$(grep PRETTY_NAME /etc/os-release | cut -d= -f2 | tr -d '"')"
+  cat > "${CAPTURE_DIR}/db/README.md" << EOF
+# sanctum — full state database
+
+| | |
+|---|---|
+| **Host** | ${HOSTNAME_SHORT} |
+| **OS** | ${OS_NAME} |
+| **Kernel** | $(uname -r) |
+| **Captured** | ${TIMESTAMP} |
+
+## Structure
+
+\`\`\`
+db/
+├── public/         Safe inventory — no secret values, git-trackable
+└── secret/
+    ├── <category>/     Secret files in plain subdirectories
+    └── secrets.index   Index of what is inside (no values)
+\`\`\`
+
+## Decrypt secrets
+
+\`\`\`bash
+# List contents without extracting
+  find db/secret -type f | sort
+
+# Read a secret file directly
+  sudo cat db/secret/wireguard/etc-wireguard/wg0.conf
+
+# Wipe after use
+find /tmp/secrets-out -type f -exec shred -u {} \\;
+rm -rf /tmp/secrets-out
+\`\`\`
+
+## What is in the secret archive
+
+See \`db/secret/secrets.index\` for a full list.
+
+Key items:
+- WireGuard private + preshared keys
+- TLS private keys (Let's Encrypt)
+- SSH host keys + user SSH keys
+- GPG secret keyrings (all users)
+- Docker .env files and full unredacted compose files
+- MariaDB credentials + schema dumps
+- i2pd destination private keys
+- Tor hidden service private keys
+- LUKS header backups
+- Lufi app secret, Grafana credentials, Alloy tokens
+- Postfix SASL credentials
+- nginx htpasswd files
+
+## Warnings during capture
+$(if [[ ${#WARNINGS[@]} -gt 0 ]]; then
+  for w in "${WARNINGS[@]}"; do echo "- ${w}"; done
+else
+  echo "None"
+fi)
+EOF
+fi
+
+# =========================================================================== #
+#  DONE
+# =========================================================================== #
+
+echo ""
+echo "╔══════════════════════════════════════════════════════╗"
+if $DRY_RUN; then
+  echo "║  dry run complete — nothing written                  ║"
+else
+  echo "║  capture-full complete ✓                             ║"
+  echo "║                                                      ║"
+  printf "║  public:  %-42s║\n" "${PUBLIC_DIR}"
+  printf "║  secret:  %-42s║\n" "${SECRET_DIR}/"
+  if [[ ${#WARNINGS[@]} -gt 0 ]]; then
+    printf "║  ⚠  %-47s║\n" "${#WARNINGS[@]} warning(s) — see db/README.md"
+  fi
+fi
+echo "╚══════════════════════════════════════════════════════╝"
+echo ""
+echo "  Next step: bootstrap.sh will read this database to"
+echo "  reproduce this machine on a fresh Debian 13 install."
+echo ""
diff --git a/straper/lib/common.sh b/straper/lib/common.sh
index 32f3581..dce03d8 100755
--- a/straper/lib/common.sh
+++ b/straper/lib/common.sh
@@ -8,7 +8,7 @@ TOOLKIT_DIR="$(cd -- "${COMMON_DIR}/.." && pwd)"
 TOOLKIT_NAME="labunix-rebuild"
 TOOLKIT_VERSION="0.1.1"
 
-: "${DB_DIR:=/srv/sanctum-rebuild}"
+: "${DB_DIR:=${SCRIPT_DIR:-/srv/sanctum-rebuild}}"
 : "${PUBLIC_DIR:=${DB_DIR}/db/public}"
 : "${SECRET_DIR:=${DB_DIR}/db/secret}"
 : "${ROLE:=lab}"                   # lab | hardware | replacement