62. pepsi-secure-link

Inspect and manage the messages held in the secure-link portal.

62.1. Role

pepsi-secure-link is the operator CLI for the secure-link fallback portal: list shows what is outstanding, show adds one message’s access log, revoke destroys a message and prune deletes what has expired. It is not a stage. Reference: pepsi-secure-link(1).

62.2. What it will not do

It reports who and when, never what. There is no subcommand that shows a stored message, no --decrypt and no escrow key: the content key is derived from the recipient’s PIN, which this server never receives and never stores, so there is nothing for an administrator to look up. When a PIN is lost, the answer is that the sender sends the message again. See The secure-link fallback portal for the whole argument and its consequences.

62.3. Running it

Run as root it adopts the pepsi service account. That role is granted every column of pepsi.secure_message except ciphertext, which is why listing works and why nothing here can print a message even by accident; pepsi-setup verifies the boundary against the live database on every run.

prune belongs in a daily cron job or systemd timer: the portal already refuses an expired token, but nothing deletes the bytes until the job runs.