{"record":{"id":"0ee45102e7bb835c","repo":"JuliusBrussee/caveman","slug":"objectstore-production-requires-tls","errorCode":null,"errorMessage":"objectstore: production requires TLS","messagePattern":"objectstore: production requires TLS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"shared/platform/objectstore/objectstore.go","lineNumber":199,"sourceCode":"\t\tif err := Probe(ctx, store); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"objectstore: production read/write/delete probe failed: %w\", err)\n\t\t}\n\t}\n\treturn store, nil\n}\n\nfunc validateConfig(cfg Config, production bool) error {\n\tif strings.TrimSpace(cfg.Endpoint) == \"\" || strings.TrimSpace(cfg.Bucket) == \"\" {\n\t\treturn errors.New(\"objectstore: endpoint and bucket are required\")\n\t}\n\tif strings.TrimSpace(cfg.AccessKey) == \"\" || strings.TrimSpace(cfg.SecretKey) == \"\" {\n\t\treturn errors.New(\"objectstore: access key and secret key are required\")\n\t}\n\tif !production {\n\t\treturn nil\n\t}\n\tif !cfg.UseSSL || strings.HasPrefix(strings.ToLower(strings.TrimSpace(cfg.Endpoint)), \"http://\") {\n\t\treturn errors.New(\"objectstore: production requires TLS\")\n\t}\n\traw := strings.TrimSpace(cfg.Endpoint)\n\tif !strings.Contains(raw, \"://\") {\n\t\traw = \"https://\" + raw\n\t}\n\tu, err := url.Parse(raw)\n\tif err != nil || u.Scheme != \"https\" || u.Hostname() == \"\" || u.User != nil || u.RawQuery != \"\" || u.Fragment != \"\" || (u.Path != \"\" && u.Path != \"/\") {\n\t\treturn errors.New(\"objectstore: production endpoint must be an HTTPS origin without credentials, path, query, or fragment\")\n\t}\n\treturn nil\n}\n\n// New constructs a MinIO/S3-backed Store. FromEnv adds a live production probe.\nfunc New(cfg Config) (Store, error) {\n\tendpoint := strings.TrimPrefix(strings.TrimPrefix(cfg.Endpoint, \"https://\"), \"http://\")\n\tclient, err := minio.New(endpoint, &minio.Options{\n\t\tCreds:  credentials.NewStaticV4(cfg.AccessKey, cfg.SecretKey, \"\"),\n\t\tSecure: cfg.UseSSL,","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/objectstore/objectstore.go#L181-L217","documentation":"validateConfig enforces TLS in production: if production is true and either UseSSL is false or the endpoint uses an http:// scheme, configuration is rejected. This prevents object data from transiting the network unencrypted in production deployments.","triggerScenarios":"Production run with S3_USE_SSL=false or unset-but-false while S3_ENDPOINT is set; endpoint explicitly given as http://... in production; config built programmatically with UseSSL:false and production=true; TLS inferred from the endpoint scheme fails because a plain host with no scheme defaults per configuration.","commonSituations":"Copy-pasting a local plaintext MinIO config (http://minio:9000) into a production deploy; disabling SSL to work around a certificate issue instead of fixing trust; forgetting S3_USE_SSL=true when the endpoint has no scheme.","solutions":["Set S3_USE_SSL=true (or Config.UseSSL=true) and ensure the endpoint is an https:// URL or a bare host that will be dialed over TLS.","Serve the MinIO/S3 endpoint with a valid TLS certificate behind a proxy if it currently only speaks plaintext.","Do not work around this by faking the environment flag to non-production; fix TLS instead.","Verify certificate trust on the client side so TLS actually succeeds after enabling it."],"exampleFix":"// before\nS3_ENDPOINT=http://minio.internal:9000\nS3_USE_SSL=false\n// after\nS3_ENDPOINT=https://minio.internal.example.com:9000\nS3_USE_SSL=true","handlingStrategy":"validation","validationCode":"if production && (!cfg.UseSSL || strings.HasPrefix(strings.ToLower(cfg.Endpoint), \"http://\")) {\n    return errors.New(\"production object store must use TLS\")\n}","typeGuard":null,"tryCatchPattern":"store, err := objectstore.New(cfg)\nif err != nil {\n    return fmt.Errorf(\"object store TLS config: %w\", err)\n}","preventionTips":["Always set S3_USE_SSL=true in production deploys","Use https:// endpoint URLs so TLS is inferred correctly","Fix certificate trust issues rather than disabling SSL","Keep local plaintext MinIO configs out of production templates"],"tags":["objectstore","security","tls","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}