{"record":{"id":"0a0fbf2b2871559a","repo":"astrid-runtime/astrid","slug":"an-already-bound-plain-http-listener-cannot-serve","errorCode":null,"errorMessage":"an already-bound plain-HTTP listener cannot serve native TLS","messagePattern":"an already-bound plain-HTTP listener cannot serve native TLS","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-gateway/src/lib.rs","lineNumber":183,"sourceCode":"}\n\n/// Run the gateway on an already-bound plain-HTTP listener.\n///\n/// # Errors\n/// Returns an error when native TLS is configured, the listener address is\n/// unavailable, or the HTTP server fails.\n#[doc(hidden)]\npub async fn run_with_capability_probe_on_listener<F>(\n    state: Arc<GatewayState>,\n    listener: TcpListener,\n    shutdown: impl Future<Output = ()> + Send + 'static,\n    capability_probe: F,\n) -> Result<()>\nwhere\n    F: Fn(&astrid_core::PrincipalId, Option<&str>, &str) -> bool + Send + Sync + 'static,\n{\n    if state.config.tls.is_some() {\n        anyhow::bail!(\"an already-bound plain-HTTP listener cannot serve native TLS\");\n    }\n    let addr = listener\n        .local_addr()\n        .context(\"failed to read pre-bound gateway listener address\")?;\n    warn_if_plaintext_non_loopback(addr);\n    state.hydrate_revocations().await?;\n    let workspace_root = std::env::current_dir().unwrap_or_else(|_| std::path::PathBuf::from(\".\"));\n    serve_http_listener(\n        state,\n        listener,\n        shutdown,\n        workspace_root,\n        astrid_core::dirs::WorkspaceLayout::default(),\n        routes::events::CapabilityProbe::new(capability_probe),\n    )\n    .await\n}\n","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-gateway/src/lib.rs#L165-L201","documentation":"Fires in run_with_capability_probe_on_listener: the caller handed in an already-bound plain TCP listener while GatewayState has a TLS config; TLS termination needs its own accept loop, so serving native TLS over that listener is refused rather than serving plaintext while believing it's TLS.","triggerScenarios":"Thrown at crates/astrid-gateway/src/lib.rs:183 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Bind the gateway through the TLS-aware startup path when config.tls is set","Clear the tls config block if plaintext HTTP on this listener is actually intended","Terminate TLS in a fronting proxy and run the gateway plain"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}