{"record":{"id":"0afa54a4dc98eb55","repo":"hashicorp/terraform","slug":"the-host-q-block-has-an-invalid-hostname-s","errorCode":null,"errorMessage":"The host %q block has an invalid hostname: %s","messagePattern":"The host %q block has an invalid hostname: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/cliconfig.go","lineNumber":298,"sourceCode":"// method. A non-nil diagnostics is not necessarily an error, since it may\n// contain just warnings.\nfunc (c *Config) Validate() tfdiags.Diagnostics {\n\tvar diags tfdiags.Diagnostics\n\n\tif c == nil {\n\t\treturn diags\n\t}\n\n\t// FIXME: Right now our config parsing doesn't retain enough information\n\t// to give proper source references to any errors. We should improve\n\t// on this when we change the CLI config parser to use HCL2.\n\n\t// Check that all \"host\" blocks have valid hostnames.\n\tfor givenHost := range c.Hosts {\n\t\t_, err := svchost.ForComparison(givenHost)\n\t\tif err != nil {\n\t\t\tdiags = diags.Append(\n\t\t\t\tfmt.Errorf(\"The host %q block has an invalid hostname: %s\", givenHost, err),\n\t\t\t)\n\t\t}\n\t}\n\n\t// Check that all \"credentials\" blocks have valid hostnames.\n\tfor givenHost := range c.Credentials {\n\t\t_, err := svchost.ForComparison(givenHost)\n\t\tif err != nil {\n\t\t\tdiags = diags.Append(\n\t\t\t\tfmt.Errorf(\"The credentials %q block has an invalid hostname: %s\", givenHost, err),\n\t\t\t)\n\t\t}\n\t}\n\n\t// Should have zero or one \"credentials_helper\" blocks\n\tif len(c.CredentialsHelpers) > 1 {\n\t\tdiags = diags.Append(\n\t\t\tfmt.Errorf(\"No more than one credentials_helper block may be specified\"),","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/cliconfig/cliconfig.go#L280-L316","documentation":"Emitted by `Config.Validate` (cliconfig.go:294-300) when a `host` block's label fails `svchost.ForComparison`. That function normalizes/validates a hostname per RFC 952/IDNA rules; an error means the label is not a usable service hostname. The `%s` values are the offending host label and the svchost error.","triggerScenarios":"A `host \"...\" { }` block in `.terraformrc` with an invalid hostname: contains underscores, spaces, empty labels, trailing dots, or invalid IDNA characters.","commonSituations":"Using `host \"_internal\"` (underscore illegal in hostnames); pasting a URL instead of a host (`host \"https://x\"`); IDN names that fail punycode conversion; a stray space or typo.","solutions":["Use a bare hostname without scheme, path, or port, e.g. `host \"example.com\"`.","Remove underscores and other illegal hostname characters from the label.","For local/private hosts, use a resolvable DNS name or a simple dotted name.","Re-run `terraform init`; `Validate` runs on every config load."],"exampleFix":"# before\nhost \"https://registry.example.com\" {\n  services = { ... }\n}\n# The host \"https://registry.example.com\" block has an invalid hostname: ...\n\n# after\nhost \"registry.example.com\" {\n  services = { ... }\n}","handlingStrategy":"validation","validationCode":"// Validate host labels with the same normalizer Terraform uses.\nimport svchost \"github.com/hashicorp/terraform-svchost\"\n\nfunc hostLabelOK(label string) error {\n    if _, err := svchost.ForComparison(label); err != nil {\n        return fmt.Errorf(\"invalid host %q: %w\", label, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use bare hostnames without scheme, path, or port in `host` blocks.","Avoid underscores and illegal characters in host labels.","Validate IDN hostnames convert to punycode before saving."],"tags":["terraform","cli-config","host","hostname","validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}