Pepsi Manual¶
Pepsi is a mail transfer agent and crypto gateway written in Rust. It receives mail over SMTP, authenticates it at the boundary, and then advances each message through a configurable chain of small stage programs — ARC sealing, SRS envelope rewriting, end-to-end encryption and decryption, DKIM signing, bounce generation, mailing-list processing and delivery (direct-to-MX, via a smarthost, or locally) — preserving the authentication verdicts the final receiver needs.
Those programs are chained over a single shared database table. Each processing step is its own program, so the pipeline can be reordered, individual steps replaced, and new behaviour added by dropping in another program — without touching the rest of the system.
Start with Introduction, which says what Pepsi is, lists its features,
compares it with the established MTAs and explains how the rest of this manual
is organised. Getting started on a cheap VPS is the walkthrough from DNS
to a first received e-mail, and The Wizard shows the pipelines
pepsi-setup --wizard builds and what each of its questions decides.
Contents
- 1. Introduction
- 2. Getting started on a cheap VPS
- 2.1. What we will build
- 2.2. Prerequisites
- 2.3. Step 1 — Delegate DNS and place the base records
- 2.4. Step 2 — Install Pepsi
- 2.5. Step 3 — Prepare the system
- 2.6. Step 4 — Write the configuration
- 2.7. Step 5 — Provision the schema, keys and certificate
- 2.8. Step 6 — Publish the remaining records and verify
- 2.9. Step 7 — Start the services
- 2.10. Step 8 — Send the first e-mail
- 2.11. Step 9 — Open the console (optional)
- 2.12. Sending mail too: add a submission port
- 2.13. Troubleshooting
- 2.14. Next steps
- 3. Installation
- 4. Debian packages
- 5. The Wizard
- 6. Configuration
- 7. Operating Pepsi
- 8. Troubleshooting
- 9. Supported Features
- 9.1. Inbound SMTP reception
- 9.2. Trace headers
- 9.3. Client authentication
- 9.4. Message submission
- 9.5. Boundary authentication
- 9.6. Authenticated Received Chain (ARC)
- 9.7. Sender Rewriting Scheme (SRS)
- 9.8. End-to-end encryption and signing
- 9.9. Server-side decryption and verification
- 9.10. Key management, discovery and publication
- 9.11. The secure-link fallback
- 9.12. Outbound DKIM signing
- 9.13. Delivery Status Notifications
- 9.14. Internationalised and 8-bit content
- 9.15. Outbound relay
- 9.16. Local delivery
- 9.17. Mailing lists and archives
- 9.18. Unsolicited mail
- 9.19. Operational features
- 9.20. Feature stability
- 10. SMTP Protocol Extensions
- 11. Key management
- 11.1. Three kinds of material
- 11.2. Custody: how a private key is stored
- 11.3. The privilege boundary
- 11.4. What custody protects against
- 11.5. Signing and encryption are separate
- 11.6. Creating identities
- 11.7. pEp-style automatic keys
- 11.8. Two keys per user
- 11.9. Publishing our users’ keys
- 11.10. Backing up and rotating the key-encryption key
- 11.11. Peer keys
- 11.12. Finding a correspondent’s key
- 11.13. A CLI walk-through
- 11.14. Configuration summary
- 11.15. See also
- 12. The secure-link fallback portal
- 13. Client interoperability
- 14. Threat model
- 14.1. How to read this chapter
- 14.2. Assets
- 14.3. Principals and how far each is trusted
- 14.4. Trust boundaries
- 14.5. Adversaries
- 14.6. End-to-end encryption: two custody modes
- 14.7. What a security indicator means
- 14.8. Per-address settings are a trust boundary
- 14.9. The network adversary
- 14.10. Availability
- 14.11. What Pepsi does not protect
- 14.12. The guarantees at a glance
- 14.13. See also
- 15. Security model
- 15.1. What Pepsi assumes
- 15.2. The privilege split
- 15.3. The private-key custody boundary
- 15.4. A second factor for key management
- 15.5. An attacker who has the database
- 15.6. An attacker who has the configuration file
- 15.7. An attacker who compromises a stage worker
- 15.8. Specific defences
- 15.9. What Pepsi does not defend against
- 15.10. Reporting a vulnerability
- 15.11. See also
- 16. Microsoft Exchange as a gateway
- 16.1. Topologies
- 16.2. The routing decision
- 16.3. Exchange Online: the tenant endpoint
- 16.4. Address family selection
- 16.5. Loop prevention
- 16.6. Exchange connector configuration
- 16.7. The Outlook add-in
- 16.8. The
X-Pepsi-*header contract - 16.9. Identity auto-provisioning
- 16.10. Key distribution
- 16.11. Troubleshooting
- 16.12. What Pepsi does not do
- 17. Mailing lists
- 17.1. This subsystem is a reimplementation of GNU Mailman 3
- 17.2. What a list is
- 17.3. How the subsystem is put together
- 17.4. Getting started
- 17.5. Styles
- 17.6. Per-list settings
- 17.7. Configuration
- 17.8. Substring search is optional
- 17.9. Two account systems
- 17.10. Bounce processing
- 17.11. Known limitations
- 17.12. Digests
- 17.13. Declared differences from GNU Mailman 3
- 18. Archives
- 19. The GNU Mailman 3 REST API
- 20. The administrative API
- 20.1. Where it is served
- 20.2. Authentication
- 20.3. Authorisation: scopes
- 20.4. Conventions
- 20.5. Pagination
- 20.6. Endpoints
- 20.7. What this server cannot do
- 20.8. Correspondent keys
- 20.9. Secure links
- 20.10. DNS records
- 20.11. Online setup
- 20.12. Hardening
- 20.13. The audit log
- 20.14. The mail log (off by default)
- 20.15. Bootstrapping
- 20.16. The browser console
- 21. The administration console
- 21.1. Three listener flags, and two of them have opposite advice
- 21.2. Reaching it safely
- 21.3. Signing in
- 21.4. What the console can and cannot do
- 21.5. The pages
- 21.6. Two templating engines, two purposes
- 21.7. No scripting, no remote assets
- 21.8. Accessibility
- 21.9. The public mailing-list pages
- 21.10. Two account systems, and neither grants the other anything
- 21.11. The member’s pages
- 21.12. The owner and moderator console
- 21.13. The interface’s language, and why it is not ten
- 22. Architecture
- 23. The message state
- 24. Extending the Pipeline
- 24.1. When a stage is the right tool
- 24.2. Anatomy of a stage crate
- 24.3. The body
- 24.4. Terminal helpers (choose exactly one)
- 24.5. Errors
- 24.6. Rules the stages live by
- 24.7. Wiring it in
- 24.8. Testing a stage
- 24.9. Adding support for migrating from another MTA
- 24.10. Integrating an external credential-refresh service
- 24.11. Database schema lifecycle
- 24.12. Keeping the feature-stability table current
- 25. Test Suite
- 26. Benchmark Suite
- 27. Performance
- 28. pepsi-ingress
- 29. pepsi-dispatch
- 30. pepsi-httpd
- 31. pepsi-stage-arc
- 32. pepsi-stage-srs
- 33. pepsi-stage-encrypt
- 34. pepsi-stage-decrypt
- 35. pepsi-stage-dkim-sign
- 36. pepsi-stage-bounce
- 37. pepsi-stage-aliases
- 38. pepsi-stage-relay-to-internet
- 39. pepsi-stage-relay-to-smarthost
- 40. pepsi-stage-relay-to-maildir
- 41. pepsi-stage-dot-forward
- 42. pepsi-stage-relay-to-lmtp
- 43. pepsi-stage-discard
- 44. pepsi-stage-anti-spam
- 45. pepsi-stage-auto-pay
- 46. pepsi-stage-check-whitelist
- 47. pepsi-stage-auto-whitelist
- 48. pepsi-stage-autocrypt-learn
- 49. pepsi-stage-reencrypt
- 50. pepsi-stage-detect-language
- 51. pepsi-detect-language
- 52. pepsi-stage-block-language
- 53. pepsi-stage-vacation
- 54. pepsi-stage-secretary
- 55. pepsi-stage-edit-settings
- 56. pepsi-stage-if
- 57. pepsi-stage-milter
- 58. pepsi-stage-route
- 59. pepsi-stage-vks-confirm
- 60. pepsi-stage-secure-link
- 61. pepsi-setup
- 62. pepsi-queue
- 63. pepsi-status
- 64. pepsi-sendmail
- 65. pepsi-whitelist
- 66. pepsi-keys
- 67. pepsi-keydisc
- 68. pepsi-settings
- 69. pepsi-list
- 70. pepsi-archive
- 71. pepsi-stage-list
- 72. pepsi-stage-list-post
- 73. pepsi-stage-list-deliver
- 74. pepsi-stage-list-command
- 75. pepsi-stage-list-bounce
- 76. pepsi-tlsrpt
- 77. pepsi-secure-link
- 78. pepsi-failure-bouncer
- 79. pepsi-quota
- 80. pepsi-helper-token-refresh
- 81. pepsi-telemetry
- 82. pepsi-telemetry-client
- 83. pepsi-config
- 84. Feature stability
- 85. Manual pages
- 86. RFC Index