{"record":{"id":"0225c9cf84f27709","repo":"hasura/graphql-engine","slug":"error-starting-server-w","errorCode":null,"errorMessage":"error starting server: %w","messagePattern":"error starting server: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli/pkg/console/consoleserver.go","lineNumber":90,"sourceCode":"\n\tc.Logger.Debugf(\n\t\t\"rendering console template [%s] with assets [%s]\",\n\t\tconsoleTemplateVersion,\n\t\tconsoleAssetsVersion,\n\t)\n\n\tconsoleServer := &http.Server{\n\t\tAddr:    fmt.Sprintf(\"%s:%s\", c.Address, c.Port),\n\t\tHandler: c.Router,\n\t}\n\n\treturn consoleServer, nil\n}\n\nfunc (c *ConsoleServer) Serve() {\n\tserver, err := c.GetHTTPServer()\n\tif err != nil {\n\t\tc.Logger.Fatal(fmt.Errorf(\"error starting server: %w\", err))\n\t\tos.Exit(1)\n\t}\n\n\tgo func() {\n\t\terr := server.ListenAndServe()\n\t\tif err != nil {\n\t\t\tif stderrors.Is(err, http.ErrServerClosed) {\n\t\t\t\tc.EC.Logger.Infof(\"server closed on port %s under signal\", c.Port)\n\t\t\t} else {\n\t\t\t\tc.EC.Logger.WithError(err).Errorf(\"error listening on port %s\", c.Port)\n\t\t\t}\n\t\t}\n\t}()\n\n\tconsoleURL := fmt.Sprintf(\"http://%s:%s/\", c.Address, c.Port)\n\n\tif !c.DontOpenBrowser {\n\t\tif c.Browser != \"\" {","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/cli/pkg/console/consoleserver.go#L72-L108","documentation":"ConsoleServer.Serve builds its net/http server via GetHTTPServer; if that fails (typically TLS cert/key problems when console TLS is configured), the CLI logs 'error starting server' via Logger.Fatal and exits with status 1. This is a fatal startup path, not a per-request error.","triggerScenarios":"Running `hasura console` with console TLS options (cert/key files) that are missing, unreadable, or invalid, or an address that can't be bound, causing GetHTTPServer to return an error before ListenAndServe.","commonSituations":"Passing --tls-cert/--tls-key with wrong paths; cert file permissions; leftover TLS flags from a copied script; port privilege issues when binding low ports as non-root.","solutions":["Check the console TLS flags: fix cert/key file paths and ensure they're readable","Validate the certificate/key pair with openssl (they must match and be valid PEM)","Remove the TLS flags if TLS isn't needed","Check the bind address/port is available and permitted"],"exampleFix":"# before\nhasura console --tls-cert ./cert.pem --tls-key ./key.pem  # wrong path -> error starting server\n\n# after\nhasura console --tls-cert /etc/ssl/cert.pem --tls-key /etc/ssl/key.pem","handlingStrategy":"validation","validationCode":"// Validate TLS material before serving\nif consoleTLS {\n    if _, err := tls.LoadX509KeyPair(certFile, keyFile); err != nil {\n        return fmt.Errorf(\"bad console TLS config: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"// Serve logs fatally and exits; guard by pre-validating GetHTTPServer\nif _, err := consoleServer.GetHTTPServer(); err != nil {\n    return err // graceful handling instead of Fatal+exit\n}","preventionTips":["Pre-validate cert/key pairs with tls.LoadX509KeyPair","Script console startup to check port availability first","Avoid low ports without privileges"],"tags":["console","tls","server-startup","hasura"],"backgroundTag":"server-startup-failed","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}