{"record":{"id":"16af58d123d79ced","repo":"xai-org/x-algorithm","slug":"env-grpc-mtls-server-crt-path-must-be-set","errorCode":null,"errorMessage":"{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set","messagePattern":"(.+?) must be set","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"visibility-filtering/config.rs","lineNumber":106,"sourceCode":"}\n\nimpl GrpcMtlsConfig {\n    pub fn from_env() -> anyhow::Result<Option<Self>> {\n        let enabled = parse_env_flag(std::env::var(ENV_GRPC_MTLS_ENABLED).ok().as_deref());\n\n        if !enabled {\n            return Ok(None);\n        }\n\n        let server_key_path = std::env::var(ENV_GRPC_MTLS_SERVER_KEY_PATH)\n            .ok()\n            .filter(|v| !v.is_empty())\n            .ok_or_else(|| anyhow::anyhow!(\"{ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set\"))?;\n\n        let server_crt_path = std::env::var(ENV_GRPC_MTLS_SERVER_CRT_PATH)\n            .ok()\n            .filter(|v| !v.is_empty())\n            .ok_or_else(|| anyhow::anyhow!(\"{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set\"))?;\n\n        let server_chain_path = std::env::var(ENV_GRPC_MTLS_SERVER_CHAIN_PATH)\n            .ok()\n            .filter(|v| !v.is_empty());\n\n        let client_ca_path = std::env::var(ENV_GRPC_MTLS_CLIENT_CA_PATH)\n            .ok()\n            .filter(|v| !v.is_empty())\n            .ok_or_else(|| anyhow::anyhow!(\"{ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set\"))?;\n\n        Ok(Some(Self {\n            server_key_path,\n            server_crt_path,\n            server_chain_path,\n            client_ca_path,\n        }))\n    }\n","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/xai-org/x-algorithm/blob/24c60942c5c5fdad3a6addffb4c6e6d2f228f04f/visibility-filtering/config.rs#L88-L124","documentation":"Raised in from_env when mTLS is enabled and GRPC_MTLS_SERVER_KEY_PATH was supplied, but GRPC_MTLS_SERVER_CRT_PATH is unset or empty. The server certificate path is mandatory whenever mTLS is on — note the key path alone is not enough.","triggerScenarios":"Enabling mTLS with the key path configured but the server certificate path env var missing/empty (partial configuration).","commonSituations":"Templates that set the key but forget the cert env; cert mounted under a different filename; humans setting only one of the pair; empty-string defaults from orchestration tools.","solutions":["Set GRPC_MTLS_SERVER_CRT_PATH to the server certificate file path","Check for trailing whitespace/quotes or empty values injected by the deployment tool","Keep key and cert envs defined adjacent in deployment manifests so they're updated together","Add a config validation step that requires the key/cert pair as a unit"],"exampleFix":"# before\nexport GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key\n# cert path missing -> error\n\n# after\nexport GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key\nexport GRPC_MTLS_SERVER_CRT_PATH=/etc/certs/server.crt","handlingStrategy":"validation","validationCode":"assert!(!env::var(\"GRPC_MTLS_SERVER_CRT_PATH\").unwrap_or_default().trim().is_empty());","typeGuard":null,"tryCatchPattern":"null","preventionTips":["Set key and cert envs together in manifests","Lint deployment templates for the mTLS var pair","Document the full required env set next to the mTLS flag"],"tags":["mtls","env-var","tls","partial-config","rust"],"backgroundTag":"missing-env-var","analyzedSha":"24c60942c5c5fdad3a6addffb4c6e6d2f228f04f","analyzedAt":"2026-08-28T11:40:14.686Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}