saphan console
The owner's console surface: the master-admin credential behind /console
saphan console
The owner's console surface: the master-admin credential behind /console
Subcommands
| Subcommand | What it does |
|---|---|
saphan console admin | The one master admin who may open /console |
saphan console admin
The one master admin who may open /console
Subcommands
| Subcommand | What it does |
|---|---|
saphan console admin set | Set or rotate the master-admin password — the verb asks for it |
saphan console admin status | Report whether /console has a usable master-admin credential |
saphan console admin set
Set or rotate the master-admin password — the verb asks for it
Asks for the new password on your terminal, the way passwd does:
echo off, asked twice, compared. It stores an argon2id digest at
<state>/console/admin.cred, mode 0600. The password itself is never stored,
never printed and never logged; it is not recoverable from the file.
$ saphan console admin set --user marcin new console password: retype new console password: console admin: credential set for user "marcin"
If the two entries differ, NOTHING is written and the verb says so in those words — the credential already on file is untouched.
There is deliberately NO --password flag: argv is world-readable through
ps and is written to shell history. The password is never an
argument, on this verb or any other.
SCRIPTS: when stdin is not a terminal the password is read from stdin instead, which is the right way to do this unattended:
printf '%s' "$PASSWORD" | saphan console admin set --user marcin
Running this against an EXISTING credential is a ROTATION: the new digest replaces the old one, and the verb prints the restart that puts it in effect — a running server does not re-read this file (docs/Console (admin) §3).
Options
| Option | Type | Default | Description |
|---|---|---|---|
--user | string | unset | the master admin's username (required) |
saphan console admin status
Report whether /console has a usable master-admin credential
Reports the credential's PRESENCE, its username, its argon2id cost parameters and the file it lives in. It never prints the digest and it can never print the password — the password is not recoverable from what is stored, by construction.
This is the verb to run first when /console refuses: it distinguishes "never provisioned" from "present but unreadable", which are different problems with different remedies (docs/Console (admin) §4).