{"record":{"id":"356880268a795e58","repo":"caddyserver/caddy","slug":"loading-ca-pool-sources-v","errorCode":null,"errorMessage":"loading CA pool sources: %v","messagePattern":"loading CA pool sources: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/capools.go","lineNumber":858,"sourceCode":"func (CombinedCAPool) CaddyModule() caddy.ModuleInfo {\n\treturn caddy.ModuleInfo{\n\t\tID: \"tls.ca_pool.source.combined\",\n\t\tNew: func() caddy.Module {\n\t\t\treturn new(CombinedCAPool)\n\t\t},\n\t}\n}\n\n// Provision implements caddy.Provisioner.\nfunc (ccp *CombinedCAPool) Provision(ctx caddy.Context) error {\n\tif len(ccp.SourcesRaw) == 0 {\n\t\treturn fmt.Errorf(\"no sources specified for combined CA pool\")\n\t}\n\n\t// Load all source modules\n\tsources, err := ctx.LoadModule(ccp, \"SourcesRaw\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"loading CA pool sources: %v\", err)\n\t}\n\n\tcaPool := x509.NewCertPool()\n\tvar allCerts []*x509.Certificate\n\n\tfor _, src := range sources.([]any) {\n\t\tca, ok := src.(CA)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"source module is not a CA pool provider\")\n\t\t}\n\t\tccp.sources = append(ccp.sources, ca)\n\n\t\tcertProvider, ok := ca.(CertificateProvider)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"source %T does not implement CertificateProvider (required for combining)\", ca)\n\t\t}\n\n\t\tcerts := certProvider.Certificates()","sourceCodeStart":840,"sourceCodeEnd":876,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/capools.go#L840-L876","documentation":"While provisioning a combined CA pool, ctx.LoadModule on the nested SourcesRaw list failed. This wraps errors from loading each child source module — unknown module IDs, invalid child config, or a child source's own provisioning error.","triggerScenarios":"A source inside `trust_pool combined { ... }` whose module name is not registered (e.g. `http` misspelled, or a plugin-based pool not compiled in), or whose own configuration is invalid so its Provision fails.","commonSituations":"Custom builds missing a plugin module referenced in the combined block; typos in source names; child source blocks with bad arguments that fail during load.","solutions":["Read the wrapped error — it identifies which child module failed and why; fix that source's name or config.","If the source comes from a plugin, rebuild with xcaddy including the plugin.","Confirm module IDs with `caddy list-modules | grep ca_pool.source`."],"exampleFix":"# before\ntrust_pool combined {\n  fille /etc/caddy/roots.pem\n}\n\n# after\ntrust_pool combined {\n  file /etc/caddy/roots.pem\n}","handlingStrategy":"validation","validationCode":"// confirm every referenced source module id exists in this build\n// after building: `caddy list-modules | grep 'tls.ca_pool.source'`\n// programmatically, keep a set of allowed sources and check generated configs against it:\nvar allowedSources = map[string]bool{\n\t\"tls.ca_pool.source.file\": true,\n\t\"tls.ca_pool.source.inline\": true,\n\t\"tls.ca_pool.source.pki_root\": true,\n\t\"tls.ca_pool.source.pki_intermediate\": true,\n\t\"tls.ca_pool.source.storage\": true,\n\t\"tls.ca_pool.source.http\": true,\n\t\"tls.ca_pool.source.system\": true,\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin and record plugin versions in the xcaddy build command committed to the repo.","Diff `caddy list-modules` output between builds in CI.","Read the wrapped error: it names the failing child module."],"tags":["caddy","caddytls","module-loading","configuration","combined-pool"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}