{"record":{"id":"0fe7b11fb7afc3e4","repo":"vxcontrol/pentagi","slug":"failed-to-create-http-client-w-0fe7b1","errorCode":null,"errorMessage":"failed to create http client: %w","messagePattern":"failed to create http client: %w","errorType":"exception","errorClass":"Fatal","httpStatus":null,"severity":"error","filePath":"backend/pkg/tools/searchers/searxng.go","lineNumber":111,"sourceCode":"\tparams.Add(\"language\", s.language())\n\tparams.Add(\"categories\", s.categories())\n\tparams.Add(\"safesearch\", s.safeSearch())\n\n\tif timeRange := s.timeRange(); timeRange != \"\" {\n\t\tparams.Add(\"time_range\", timeRange)\n\t}\n\n\tif maxResults > 0 {\n\t\tparams.Add(\"limit\", strconv.Itoa(maxResults))\n\t} else {\n\t\tparams.Add(\"limit\", \"10\")\n\t}\n\n\tapiURL.RawQuery = params.Encode()\n\n\tclient, err := system.GetHTTPClient(s.cfg)\n\tif err != nil {\n\t\treturn \"\", Fatal(fmt.Errorf(\"failed to create http client: %w\", err))\n\t}\n\n\tclient.Timeout = s.timeout()\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL.String(), nil)\n\tif err != nil {\n\t\treturn \"\", Fatal(fmt.Errorf(\"failed to create request: %w\", err))\n\t}\n\n\treq.Header.Set(\"User-Agent\", \"PentAGI/1.0\")\n\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", Retryable(fmt.Errorf(\"failed to do request: %w\", err), 0)\n\t}\n\tdefer resp.Body.Close()\n\n\treturn s.parseHTTPResponse(resp, query)","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/tools/searchers/searxng.go#L93-L129","documentation":"The SearxNG searcher builds its HTTP client via system.GetHTTPClient(s.cfg), which constructs a client honoring the app's TLS/proxy configuration. Failure here (wrapped as Fatal) means the secure client could not be initialized — typically a problem loading the CA certificate pool or TLS material from configuration, before any network call is attempted.","triggerScenarios":"Custom CA/TLS configuration in the app config pointing to a missing or unreadable certificate file; invalid proxy settings that the http.Transport builder rejects; corrupted cert pool initialization in system.GetHTTPClient.","commonSituations":"Mounting a custom CA cert path into the container but the file is absent or has wrong permissions; typo in the CA path env var; running with a restrictive read-only filesystem where cert files are not present.","solutions":["Check the TLS/CA configuration values passed via env (custom CA file path) and confirm the file exists and is readable inside the container","Look at system.GetHTTPClient to see which config fields it consumes and validate each","Fix file permissions (chmod 644) or correct the cert path in docker-compose.yml/.env","Remove the custom TLS override temporarily to confirm the default client works","This error is Fatal and non-retryable — it will recur on every search until config is fixed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// preflight: verify custom CA material is readable before constructing the client\nif caPath := os.Getenv(\"CUSTOM_CA_PATH\"); caPath != \"\" {\n    if _, err := os.ReadFile(caPath); err != nil {\n        log.Fatalf(\"CA cert unreadable: %v\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount CA files into containers and verify permissions (readable by the process user)","Check the config fields system.GetHTTPClient consumes at startup","Keep a startup smoke test that builds the HTTP client once and reports config problems","Avoid pointing CA/proxy env vars at non-existent paths in read-only filesystems"],"tags":["http-client","tls","configuration","searxng"],"backgroundTag":"http-client-init-failure","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}