From 6b59b75c3a294060dea66bdee16ffaf95ae92889 Mon Sep 17 00:00:00 2001
From: Lukasz Kasprzak <lukasz.kasprzak@pm.me>
Date: Fri, 20 Mar 2026 16:10:48 +0100
Subject: feat: capture-full self-contained, db/ relative to toolkit dir

---
 straper/.gitignore      | 1 +
 straper/capture-full.sh | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)
 create mode 100644 straper/.gitignore

diff --git a/straper/.gitignore b/straper/.gitignore
new file mode 100644
index 0000000..72becb4
--- /dev/null
+++ b/straper/.gitignore
@@ -0,0 +1 @@
+db/secret/
diff --git a/straper/capture-full.sh b/straper/capture-full.sh
index a8f0e3f..394e4ce 100755
--- a/straper/capture-full.sh
+++ b/straper/capture-full.sh
@@ -23,10 +23,10 @@
 #   - GPG_RECIPIENT must be set (key fingerprint or email), OR
 #     set it in /etc/labunix/capture.conf or ~/.config/labunix/capture.conf
 #   - jq must be installed: apt install jq
-#   - Output goes to CAPTURE_DIR (default: /srv/sanctum-rebuild)
+#   - Output goes to CAPTURE_DIR (default: <toolkit-dir>/db/)
 #
 # OUTPUT STRUCTURE
-#   /srv/sanctum-rebuild/
+#   <toolkit-dir>/db/
 #   ├── capture-full.sh         this script (self-referential copy)
 #   ├── bootstrap.sh            reproduction script (generated separately)
 #   ├── db/
@@ -48,7 +48,7 @@
 #   - db/public/  : safe to push to private git repo
 #   - db/secret/  : local only, root-only permissions (chmod 700)
 #                     protected by ZFS-on-LUKS disk encryption
-#   - The .gitignore in CAPTURE_DIR excludes db/secret/ entirely
+#   - The .gitignore in the toolkit dir excludes db/secret/ entirely
 #   - bootstrap.sh reads db/public/ for structure and db/secret/ for values
 # =============================================================================
 
@@ -57,7 +57,8 @@ set -euo pipefail
 # --------------------------------------------------------------------------- #
 #  CONFIGURATION
 # --------------------------------------------------------------------------- #
-CAPTURE_DIR="${CAPTURE_DIR:-/srv/sanctum-rebuild}"
+SCRIPT_DIR="$(cd -- "$(dirname -- "$0")" && pwd)"
+CAPTURE_DIR="${CAPTURE_DIR:-${SCRIPT_DIR}}"
 PUBLIC_DIR="${CAPTURE_DIR}/db/public"
 SECRET_DIR="${CAPTURE_DIR}/db/secret"
 TIMESTAMP="$(date +"%Y-%m-%dT%H:%M:%S")"
-- 
cgit v1.3