Encrypted Vault for VPN Secrets and Residual Logs

TL;DR: A LUKS2 file-backed vault holds VPN configuration files, private keys, PKI certificates, and any leftover runtime logs. It protects sensitive assets if a powered-off or decommissioned VPS disk is imaged or inspected.