What causes "fleet alert URL from {name} must use https" in Hmbown/CodeWhale?

Use an https:// URL — terminate TLS at a reverse proxy if the backend speaks plain HTTP

fleet alert URL from {name} must use https

Error message

fleet alert URL from {name} must use https

What it means

After a URL secret resolves, `validate_https_alert_url` parses it and requires scheme `https` (fleet/alerts.rs:507). http:// and every other scheme are rejected so alert payloads never travel in cleartext.

Source

Thrown at crates/tui/src/fleet/alerts.rs:507

        .ok_or_else(|| anyhow!("fleet alert secret {name} is not configured"))
}

fn required_https_url<R>(resolver: &R, name: &str) -> Result<String>
where
    R: FleetAlertSecretResolver,
{
    let url = resolver
        .resolve(name)
        .ok_or_else(|| anyhow!("fleet alert URL {name} is not configured"))?;
    validate_https_alert_url(name, &url)?;
    Ok(url)
}

fn validate_https_alert_url(name: &str, url: &str) -> Result<()> {
    let parsed = reqwest::Url::parse(url)
        .with_context(|| format!("fleet alert URL from {name} is not a valid URL"))?;
    if parsed.scheme() != "https" {
        return Err(anyhow!("fleet alert URL from {name} must use https"));
    }
    Ok(())
}

fn short_reason(reason: &str) -> String {
    let trimmed = reason.trim();
    if trimmed.len() <= 240 {
        return trimmed.to_string();
    }
    let prefix: String = trimmed.chars().take(237).collect();
    format!("{prefix}...")
}

fn default_pagerduty_severity() -> String {
    "error".to_string()
}

#[cfg(test)]

View on GitHub (pinned to 8880682c63)

Solutions

Use an https:// URL — terminate TLS at a reverse proxy if the backend speaks plain HTTP
Or point at an https relay that forwards to the internal endpoint
Fix scheme typos in the URL variable

Example fix

# before
export FLEET_ALERT_WEBHOOK_URL=http://10.0.0.5:9090/hook
# after
export FLEET_ALERT_WEBHOOK_URL=https://alerts.internal/hook

Defensive patterns

Strategy: validation

Validate before calling

let raw = std::env::var(&adapter.url_env).context("URL not configured")?;
let parsed = reqwest::Url::parse(&raw)?;
anyhow::ensure!(parsed.scheme() == "https", "alert URL must be https: {raw}");

Type guard

fn is_https_url(raw: &str) -> bool {
    reqwest::Url::parse(raw)
        .map(|u| u.scheme() == "https")
        .unwrap_or(false)
}

Prevention

Provision only https endpoints for alert delivery
Front plain-HTTP receivers with a TLS-terminating proxy
Validate the scheme at config load, not at dispatch time

When it happens

Trigger: The URL variable contains an `http://` endpoint because the internal receiver has no TLS; a localhost test URL; a scheme typo that fails parsing or a non-http scheme that fails the check.

Common situations: Local testing endpoints; internal relays without TLS; proxies that terminate TLS while config points at the plain internal port.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@8880682c63 (2026-08-16). Data as JSON: /api/errors/aab209b97c6be56a. Report an issue: GitHub.