{"record":{"id":"282f9ff639c6c330","repo":"JuliusBrussee/caveman","slug":"production-kms-configuration-w","errorCode":null,"errorMessage":"production KMS configuration: %w","messagePattern":"production KMS configuration: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"shared/platform/env/env.go","lineNumber":74,"sourceCode":"// refusals and silently skip the rest. Whitespace and case are therefore folded\n// in — the direction that turns MORE deployments on, never fewer.\nfunc IsProduction() bool {\n\treturn runtimeenv.IsProduction()\n}\n\nfunc RefuseProductionDefaults() error {\n\tif !IsProduction() {\n\t\treturn nil\n\t}\n\tif err := validateProductionTextSecrets([]string{\n\t\t\"CAVE_KEY_HASH_PEPPER\",\n\t\t\"CAVE_JWT_SIGNING_KEY\",\n\t\t\"CAVE_BOOTSTRAP_TOKEN\",\n\t}); err != nil {\n\t\treturn err\n\t}\n\tif err := kms.ValidateProduction(); err != nil {\n\t\treturn fmt.Errorf(\"production KMS configuration: %w\", err)\n\t}\n\treturn validateProductionPublicURL()\n}\n\n// RefuseGatewayProductionDefaults validates only material the public data plane\n// consumes. Control-plane JWT/bootstrap secrets must never be injected into the\n// gateway merely to satisfy a shared configuration check.\nfunc RefuseGatewayProductionDefaults() error {\n\tif !IsProduction() {\n\t\treturn nil\n\t}\n\tif err := validateProductionTextSecrets([]string{\"CAVE_KEY_HASH_PEPPER\"}); err != nil {\n\t\treturn err\n\t}\n\tif Bool(\"CAVE_REPLAY_ENABLED\", false) {\n\t\tif err := validateProductionTextSecrets([]string{\"CAVE_ROUTER_REPLAY_TOKEN\"}); err != nil {\n\t\t\treturn err\n\t\t}","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/env/env.go#L56-L92","documentation":"RefuseProductionDefaults wraps a failure from kms.ValidateProduction() with the prefix 'production KMS configuration'. In production mode this library refuses to start unless the KMS is properly configured (real key IDs/credentials, not local/placeholder settings). It is thrown so the process fails fast instead of running production traffic against default or unusable KMS settings.","triggerScenarios":"Calling RefuseProductionDefaults (e.g. at startup with production mode enabled) while kms.ValidateProduction() reports the KMS env/keys are unset, defaulted, or otherwise invalid.","commonSituations":"Deploying with CAVE_ENV=production but no KMS key configured; copying a local dev compose file to prod; upgrading to a version that added KMS validation; missing cloud credentials so the KMS resolver falls back to defaults.","solutions":["Configure the KMS variables kms.ValidateProduction() requires (key ID, region, credentials) with real production values.","Inspect the wrapped cause (%w) in the error chain for the specific KMS problem and fix that first.","If this is not a production deployment, run in local mode where KMS defaults are allowed.","Verify cloud credentials are present in the deployment environment so the real KMS is resolvable."],"exampleFix":"// before\n// prod deploy with no KMS key set\nCAVE_ENV=production ./cave  // -> production KMS configuration: ...\n\n// after\nexport CAVE_ENV=production\nexport CAVE_KMS_KEY_ID=arn:aws:kms:us-east-1:123456789:key/abcd-...\nexport AWS_REGION=us-east-1\n./cave","handlingStrategy":"validation","validationCode":"if os.Getenv(\"CAVE_ENV\") == \"production\" {\n    if os.Getenv(\"CAVE_KMS_KEY_ID\") == \"\" {\n        return errors.New(\"CAVE_KMS_KEY_ID must be set before starting in production\")\n    }\n}\n// then call env.RefuseProductionDefaults()","typeGuard":null,"tryCatchPattern":"if err := env.RefuseProductionDefaults(); err != nil {\n    var kmsErr error\n    if errors.As(err, &kmsErr) && strings.Contains(err.Error(), \"production KMS configuration\") {\n        log.Fatalf(\"fix KMS config: %v\", err) // fail fast with the wrapped cause\n    }\n    return err\n}","preventionTips":["Run RefuseProductionDefaults in CI against a production-like env to catch KMS gaps before deploy.","Keep all secret/KMS material in a secret manager injected at deploy time, never defaulted.","Log the full error chain (%w cause) to identify the exact KMS problem."],"tags":["kms","production","configuration","startup"],"backgroundTag":"missing-required-config","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}