{"record":{"id":"10bf9d77e9f82ace","repo":"puppetlabs/puppet","slug":"invalid-argument-var-at-error-location","errorCode":null,"errorMessage":"Invalid argument '%{var}' at %{error_location}","messagePattern":"Invalid argument '%(.+?)' at %(.+?)","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/file_serving/configuration/parser.rb","lineNumber":46,"sourceCode":"          mount = newmount(::Regexp.last_match(1))\n        when /^\\s*(\\w+)\\s+(.+?)(\\s*#.*)?$/\n          var = ::Regexp.last_match(1)\n          value = ::Regexp.last_match(2)\n          value.strip!\n          raise(ArgumentError, _(\"Fileserver configuration file does not use '=' as a separator\")) if value =~ /^=/\n\n          case var\n          when \"path\"\n            path(mount, value)\n          when \"allow\", \"deny\"\n            # ignore `allow *`, otherwise report error\n            if var != 'allow' || value != '*'\n              error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)\n              Puppet.err(\"Entry '#{line.chomp}' is unsupported and will be ignored at #{error_location_str}\")\n            end\n          else\n            error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)\n            raise ArgumentError, _(\"Invalid argument '%{var}' at %{error_location}\") %\n                                 { var: var, error_location: error_location_str }\n          end\n        else\n          error_location_str = Puppet::Util::Errors.error_location(@file.filename, @count)\n          raise ArgumentError, _(\"Invalid entry at %{error_location}: '%{file_text}'\") %\n                               { file_text: line.chomp, error_location: error_location_str }\n        end\n      end\n    end\n\n    validate\n\n    @mounts\n  end\n\n  def initialize(filename)\n    @file = Puppet::Util::WatchedFile.new(filename)\n  end","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/file_serving/configuration/parser.rb#L28-L64","documentation":"The fileserver.conf parser accepts only `path`, `allow`, and `deny` keys inside a mount block. Any other key raises ArgumentError 'Invalid argument <key> at <file>:<line>' naming the offending entry. Note that allow/deny lines themselves are only warned about and ignored (Puppet 5+ deprecated them in fileserver.conf); unknown keys are hard errors.","triggerScenarios":"fileserver.conf containing a key like `allow_ip 10.0.0.0/8` under a mount block (a Puppet 2.x-era option); a misspelled key (`pat /files`); keys copied from auth.conf or other Puppet configuration files.","commonSituations":"Configs migrated from very old Puppet versions; copy-paste from stale documentation; operators assuming fileserver.conf shares auth.conf's key vocabulary.","solutions":["Open the reported file:line and remove or correct the key — only path, allow, deny are valid in a mount","Move ACL logic out of fileserver.conf: use auth.conf / server-side ACLs (allow/deny here are deprecated and ignored anyway)","Validate the file after editing: restart puppetserver and watch the log for parse warnings"],"exampleFix":"# /etc/puppetlabs/puppet/fileserver.conf — before\n[extra_files]\n  path /etc/puppetlabs/code/files/extra\n  allow_ip 10.0.0.0/8\n# after\n[extra_files]\n  path /etc/puppetlabs/code/files/extra\n# (ACLs enforced in auth.conf instead)","handlingStrategy":"validation","validationCode":"VALID_KEYS = %w[path allow deny].freeze\nFile.readlines('/etc/puppetlabs/puppet/fileserver.conf').each_with_index do |line, i|\n  key = line.split.first.to_s\n  next if key.empty? || key.start_with?('#', '[')\n  raise \"fileserver.conf:#{i + 1}: invalid key '#{key}'\" unless VALID_KEYS.include?(key)\nend","typeGuard":null,"tryCatchPattern":"begin\n  Puppet::FileServing::Configuration.configuration_from(file)\nrescue ArgumentError => e\n  # e.message contains file:line of the bad entry — surface it to the operator\n  raise \"fileserver.conf rejected: #{e.message}\"\nend","preventionTips":["Restrict fileserver.conf mounts to path (+ optionally allow/deny, knowing they are deprecated)","Put network ACLs in auth.conf / server ACL layers, not fileserver.conf","Lint config files in CI before deploying to the server"],"tags":["puppet","file-serving","fileserver-conf","config","parser"],"backgroundTag":"invalid-config-key","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}