77. pepsi-secure-link

Inspect and manage the messages held in the secure-link portal.

77.1. Role

pepsi-secure-link is the operator CLI for the secure-link fallback portal: list shows what is outstanding (--limit, --expired to include messages that have expired but not yet been pruned, --json), show TOKEN adds one message’s access log, revoke TOKEN destroys a message and prune deletes what has expired (--grace-hours keeps it a while longer). It is not a stage. Reference: pepsi-secure-link(1).

77.2. What it will not do

It reports who and when, never what. There is no subcommand that shows a stored message, no --decrypt and no escrow key: the content key is derived from the recipient’s PIN, which this server never stores, so there is nothing for an administrator to look up. When a PIN is lost, the answer is that the sender sends the message again. See The secure-link fallback portal for the whole argument and its consequences.

77.3. Running it

Run as root it adopts the pepsi service account. That role can read every column of pepsi.secure_message except ciphertext, which is why listing works and why nothing here can print a message even by accident; pepsi-setup verifies the boundary against the live database on every run.

prune belongs in a daily cron job or systemd timer: the portal already refuses an expired token, but nothing deletes the bytes until the job runs.