{"record":{"id":"0a9ff85f3f8a8cf3","repo":"zitadel/zitadel","slug":"system-defaults-config-invalid-w","errorCode":null,"errorMessage":"system defaults config invalid: %w","messagePattern":"system defaults config invalid: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/start/config.go","lineNumber":136,"sourceCode":"\t// Legacy logger\n\terr = config.Log.SetLogger()\n\tif err != nil {\n\t\terr = errors.Join(err, shutdown(cmd.Context()))\n\t\treturn nil, nil, fmt.Errorf(\"unable to set logger: %w\", err)\n\t}\n\n\tid.Configure(config.Machine)\n\n\tvar actionsDenylist []denylist.AddressChecker\n\tif config.Actions != nil {\n\t\tactionsDenylist = config.Actions.HTTP.DenyList\n\t}\n\tconfig.HTTPClient.MergeDeprecatedDenylists(actionsDenylist, config.Executions.DenyList)\n\n\terr = config.SystemDefaults.Validate()\n\tif err != nil {\n\t\terr = errors.Join(err, shutdown(cmd.Context()))\n\t\treturn nil, nil, fmt.Errorf(\"system defaults config invalid: %w\", err)\n\t}\n\t// Copy the global role permissions mappings to the instance until we allow instance-level configuration over the API.\n\tconfig.DefaultInstance.RolePermissionMappings = config.InternalAuthZ.RolePermissionMappings\n\n\treturn config, shutdown, nil\n}\n\nfunc readConfig(v *viper.Viper) (*Config, error) {\n\tconfig := new(Config)\n\n\terr := v.Unmarshal(config,\n\t\tviper.DecodeHook(mapstructure.ComposeDecodeHookFunc(\n\t\t\thooks.SliceTypeStringDecode[*domain.CustomMessageText],\n\t\t\thooks.SliceTypeStringDecode[authz.RoleMapping],\n\t\t\thooks.MapTypeStringDecode[string, *authz.SystemAPIUser],\n\t\t\thooks.MapHTTPHeaderStringDecode,\n\t\t\tdatabase.DecodeHook(false),\n\t\t\tactions.HTTPConfigDecodeHook,","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/zitadel/zitadel/blob/13948f2bcd6f257794dbd6d342c2ac30bc88fe54/cmd/start/config.go#L118-L154","documentation":"NewConfig validates the SystemDefaults section of the ZITADEL startup configuration. If SystemDefaults.Validate() fails, the error is wrapped as 'system defaults config invalid' and joined with the shutdown error from terminating the command context. It indicates the built-in/default values derived from config (typically from defaults.yaml plus overrides) are internally inconsistent or incomplete.","triggerScenarios":"Calling NewConfig (via `zitadel start`/`start-from-init`) when config.SystemDefaults contains invalid values — e.g. malformed durations, empty required fields, or invalid secret generator/language settings after merging defaults.yaml, config file, and env overrides.","commonSituations":"Hand-edited or partially overridden defaults.yaml; environment variables that override SystemDefaults fields with invalid formats; upgrading ZITADEL and reusing an old config missing newly required SystemDefaults fields.","solutions":["Check the wrapped cause (%w) in the log for the exact failing field in SystemDefaults.Validate","Restore/merge your config with the defaults.yaml shipped for your ZITADEL version so all SystemDefaults fields are present","Fix the specific invalid value (e.g. duration syntax, empty field) in your config file or offending ZITADEL_* env var","Run with a pristine defaults.yaml to confirm the stock config validates, then reapply overrides incrementally"],"exampleFix":"// before (config override via env)\nZITADEL_SYSTEMDEFAULTS_SECRETGENERATORS_OTP_MINFREQUENCY=notanumber\n// after\nZITADEL_SYSTEMDEFAULTS_SECRETGENERATORS_OTP_MINFREQUENCY=1000000","handlingStrategy":"validation","validationCode":"// before start: sanity-check SystemDefaults via config load\n_, shutdown, err := cmd.NewConfig(ctx)\nif err != nil { log.Fatalf(\"config invalid: %v\", err) }\n_ = shutdown","typeGuard":null,"tryCatchPattern":"// Go: inspect wrapped error\nif err != nil {\n    var cfgErr error\n    if errors.As(err, &cfgErr) { log.Printf(\"cause: %v\", cfgErr) }\n    os.Exit(1)\n}","preventionTips":["Keep your config file merged with the version-matched defaults.yaml","Lint env var overrides for format (durations, numbers) before deploy","Diff your overrides against upstream defaults when upgrading"],"tags":["config","startup","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"13948f2bcd6f257794dbd6d342c2ac30bc88fe54","analyzedAt":"2026-09-06T10:16:19.814Z","contentChangedAt":"2026-09-06T10:16:19.814Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}