{"record":{"id":"2e68c2f2c37ee6d0","repo":"benbjohnson/litestream","slug":"age-encryption-is-not-currently-supported-if-you","errorCode":null,"errorMessage":"age encryption is not currently supported, if you need encryption please revert back to Litestream v0.3.x","messagePattern":"age encryption is not currently supported, if you need encryption please revert back to Litestream v0\\.3\\.x","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/litestream/main.go","lineNumber":1362,"sourceCode":"\tName string `yaml:\"name\"` // Deprecated\n\tPath string `yaml:\"path\"`\n\tURL  string `yaml:\"url\"`\n}\n\n// NewReplicaFromConfig instantiates a replica for a DB based on a config.\nfunc NewReplicaFromConfig(c *ReplicaConfig, db *litestream.DB) (_ *litestream.Replica, err error) {\n\t// Ensure user did not specify URL in path.\n\tif litestream.IsURL(c.Path) {\n\t\treturn nil, fmt.Errorf(\"replica path cannot be a url, please use the 'url' field instead: %s\", c.Path)\n\t}\n\n\t// Reject age encryption configuration as it's currently non-functional.\n\t// Age encryption support was removed during the LTX storage layer refactor\n\t// and has not been reimplemented. Accepting this config would silently\n\t// write plaintext data to remote storage instead of encrypted data.\n\t// See: https://github.com/benbjohnson/litestream/issues/790\n\tif len(c.Age.Identities) > 0 || len(c.Age.Recipients) > 0 {\n\t\treturn nil, fmt.Errorf(\"age encryption is not currently supported, if you need encryption please revert back to Litestream v0.3.x\")\n\t}\n\n\t// Build replica.\n\tr := litestream.NewReplica(db)\n\tif v := c.SyncInterval; v != nil {\n\t\tr.SyncInterval = *v\n\t}\n\tif v := c.MaxSyncLTXFiles; v != nil {\n\t\tr.MaxSyncLTXFiles = *v\n\t}\n\tif v := c.AutoRecover; v != nil {\n\t\tr.AutoRecoverEnabled = *v\n\t}\n\n\t// Build and set client on replica.\n\tswitch c.ReplicaType() {\n\tcase \"file\":\n\t\tif r.Client, err = newFileReplicaClientFromConfig(c, r); err != nil {","sourceCodeStart":1344,"sourceCodeEnd":1380,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/cmd/litestream/main.go#L1344-L1380","documentation":"Age encryption was removed during the LTX storage layer refactor and is non-functional; configs specifying age identities or recipients are rejected outright so users do not silently write plaintext to remote storage (see litestream issue #790).","triggerScenarios":"A replica config contains any entries under `age.identities` or `age.recipients`, evaluated in NewReplicaFromConfig at startup.","commonSituations":"Upgrading encrypted v0.3.x deployments to v0.5+/LTX-era Litestream; copy-pasted configs from old documentation or blog posts recommending age encryption.","solutions":["Remove the entire `age:` block from the replica config","If encryption is required, revert to Litestream v0.3.x as the error message states","Re-encrypt backups at the storage layer instead (e.g. bucket-side encryption/KMS)"],"exampleFix":"# before\nreplicas:\n  - url: s3://bucket/db\n    age:\n      recipients: [age1xyz...]\n# after\nreplicas:\n  - url: s3://bucket/db","handlingStrategy":"validation","validationCode":"if len(cfg.Age.Identities) > 0 || len(cfg.Age.Recipients) > 0 {\n    return errors.New(\"age encryption unsupported; remove age block or pin litestream v0.3.x\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove age blocks when upgrading past the LTX refactor","Use storage-side encryption instead of age","Pin versions deliberately if encryption via age is a hard requirement"],"tags":["config","encryption","deprecated","replica"],"backgroundTag":"unsupported-config-value","analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}