{"record":{"id":"18a6ef2bf2c36ea8","repo":"block/buzz","slug":"invalid-buzz-relay-private-key-e","errorCode":null,"errorMessage":"invalid BUZZ_RELAY_PRIVATE_KEY: {e}","messagePattern":"invalid BUZZ_RELAY_PRIVATE_KEY: (.+?)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/buzz-admin/src/main.rs","lineNumber":557,"sourceCode":"        \"NIP-43 membership list published by buzz-admin\"\n    );\n    Ok(())\n}\n\n/// Connect to DB, Redis pub/sub, and load the relay keypair.\n///\n/// `BUZZ_RELAY_PRIVATE_KEY` is required — the CLI signs kind:13534 events.\nasync fn connect_member_services() -> Result<(Db, Arc<PubSubManager>, Keys)> {\n    let db = connect_db().await?;\n\n    let relay_keypair = {\n        let hex = std::env::var(\"BUZZ_RELAY_PRIVATE_KEY\").map_err(|_| {\n            anyhow::anyhow!(\n                \"BUZZ_RELAY_PRIVATE_KEY is required for add-member/remove-member.\\n\\\n                 The relay must have a stable signing key to publish kind:13534 events.\"\n            )\n        })?;\n        Keys::parse(&hex).map_err(|e| anyhow::anyhow!(\"invalid BUZZ_RELAY_PRIVATE_KEY: {e}\"))?\n    };\n\n    let redis_url =\n        std::env::var(\"REDIS_URL\").unwrap_or_else(|_| \"redis://localhost:6379\".to_string());\n\n    let redis_pool = {\n        let cfg = deadpool_redis::Config::from_url(&redis_url);\n        cfg.create_pool(Some(deadpool_redis::Runtime::Tokio1))\n            .map_err(|e| anyhow::anyhow!(\"Redis pool creation failed: {e}\"))?\n    };\n\n    let pubsub = Arc::new(\n        PubSubManager::new(&redis_url, redis_pool)\n            .await\n            .map_err(|e| anyhow::anyhow!(\"PubSub init failed: {e}\"))?,\n    );\n\n    Ok((db, pubsub, relay_keypair))","sourceCodeStart":539,"sourceCodeEnd":575,"githubUrl":"https://github.com/block/buzz/blob/ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be/crates/buzz-admin/src/main.rs#L539-L575","documentation":"Keys::parse accepts only a 32-byte hex secret key or a bech32 nsec… string. Any other shape — truncated or padded hex, '0x' prefix, an npub (public key) pasted by mistake, surrounding quotes/whitespace from a .env file, or a passphrase — returns Err, surfaced as 'invalid BUZZ_RELAY_PRIVATE_KEY'. The check runs after the presence check, so the variable is set but its value is not a usable secret.","triggerScenarios":"BUZZ_RELAY_PRIVATE_KEY contains an npub/public key, a 63- or 65-char string, a quoted value from .env, or an nsec with a typo (bech32 checksum failure).","commonSituations":"Copy-paste truncation; using the public key because it was the handier string from the relay logs; .env values wrapped in quotes by a deployment tool.","solutions":["Hex form must be exactly 64 chars: echo -n \"$BUZZ_RELAY_PRIVATE_KEY\" | wc -c (expect 64).","If using nsec form, re-copy it fully — bech32 checksums fail loudly on any typo.","Make sure it is the SECRET key (hex or nsec), not the npub/public key.","Strip quotes/whitespace: export BUZZ_RELAY_PRIVATE_KEY=$(echo \"$BUZZ_RELAY_PRIVATE_KEY\" | tr -d '\"' | tr -d \"'\")."],"exampleFix":"# before\nBUZZ_RELAY_PRIVATE_KEY=\"8a3f...\"   # quotes stored as part of the value by a deploy tool\n# after\nBUZZ_RELAY_PRIVATE_KEY=8a3f...       # bare 64-hex value, no quotes","handlingStrategy":"validation","validationCode":"# accept only 64-hex or nsec… before running the command\nkey=\"$BUZZ_RELAY_PRIVATE_KEY\"\ncase \"$key\" in\n  nsec1*) ;;\n  *) [ \"${#key}\" -eq 64 ] && echo \"$key\" | grep -qE '^[0-9a-fA-F]{64}$' || { echo 'bad key format' >&2; exit 3; } ;;\nesac","typeGuard":"fn is_usable_secret(key: &str) -> bool {\n    let k = key.trim();\n    (k.len() == 64 && k.chars().all(|c| c.is_ascii_hexdigit()))\n        || k.starts_with(\"nsec1\")\n}","tryCatchPattern":null,"preventionTips":["Never wrap key values in quotes in .env files.","Store the secret as nsec if humans copy it — bech32 checksums catch truncation.","Label keys unambiguously (RELAY_SECRET vs RELAY_PUBLIC) in secret stores so the npub is never grabbed by mistake."],"tags":["buzz-admin","nostr","private-key","env-var","validation"],"backgroundTag":"invalid-private-key","analyzedSha":"ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be","analyzedAt":"2026-08-20T04:38:24.874Z","contentChangedAt":"2026-08-20T04:38:24.874Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}