{"record":{"id":"31069e4c6a4a1cf5","repo":"caddyserver/caddy","slug":"creating-tls-storage-configuration-v-31069e","errorCode":null,"errorMessage":"creating TLS storage configuration: %v","messagePattern":"creating TLS storage configuration: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/distributedstek/distributedstek.go","lineNumber":82,"sourceCode":"\treturn caddy.ModuleInfo{\n\t\tID:  \"tls.stek.distributed\",\n\t\tNew: func() caddy.Module { return new(Provider) },\n\t}\n}\n\n// Provision provisions s.\nfunc (s *Provider) Provision(ctx caddy.Context) error {\n\ts.ctx = ctx\n\n\t// unpack the storage module to use, if different from the default\n\tif s.Storage != nil {\n\t\tval, err := ctx.LoadModule(s, \"Storage\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading TLS storage module: %s\", err)\n\t\t}\n\t\tcmStorage, err := val.(caddy.StorageConverter).CertMagicStorage()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"creating TLS storage configuration: %v\", err)\n\t\t}\n\t\ts.storage = cmStorage\n\t}\n\n\t// otherwise, use default storage\n\tif s.storage == nil {\n\t\ts.storage = ctx.Storage()\n\t}\n\n\treturn nil\n}\n\n// Initialize sets the configuration for s and returns the starting keys.\nfunc (s *Provider) Initialize(config *caddytls.SessionTicketService) ([][32]byte, error) {\n\t// keep a reference to the config; we'll need it when rotating keys\n\ts.stekConfig = config\n\n\tdstek, err := s.getSTEK()","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/distributedstek/distributedstek.go#L64-L100","documentation":"After loading the custom storage module for distributed STEKs, Provision calls CertMagicStorage() to obtain the certmagic.Storage implementation; failure is wrapped as 'creating TLS storage configuration'. The module loaded, but failed to produce a usable storage backend.","triggerScenarios":"A storage module whose CertMagicStorage() errors — e.g. invalid connection settings, missing credentials, or unsupported configuration for the storage backend.","commonSituations":"Redis storage plugin with unreachable host in config, wrong database index, or auth mismatch; environment variables for storage credentials missing at provision time.","solutions":["Read the wrapped error after the colon — it contains the storage backend's own message","Fix the storage module's options (connection strings, credentials, addresses)","Verify backend reachability from the Caddy host (redis-cli ping, etc.) before restarting Caddy"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-deploy: prove the storage backend answers before Caddy provisions it\n// (shell, redis example) redis-cli -h <host> -a $REDIS_PASS ping","typeGuard":null,"tryCatchPattern":"// Wrap Caddy startup so provision failures surface the backend cause\nif err := caddy.Run(cfg); err != nil {\n\tif strings.Contains(err.Error(), \"creating TLS storage configuration\") {\n\t\t// the suffix after the colon carries the backend error (auth, network, options)\n\t\tlog.Printf(\"storage backend rejected config: %v\", err)\n\t}\n}","preventionTips":["Health-check storage backends in the container entrypoint before exec'ing caddy","Manage storage credentials via environment injection, not baked config","Test the exact storage module config in staging with the same plugin build"],"tags":["tls","stek","storage","configuration"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}