{"record":{"id":"3dd6a1a068737de0","repo":"crowdsecurity/crowdsec","slug":"while-opening-capi-whitelist-file-w","errorCode":null,"errorMessage":"while opening capi whitelist file: %w","messagePattern":"while opening capi whitelist file: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":499,"sourceCode":"\t\t\treturn nil, err\n\t\t}\n\n\t\tret.Cidrs[idx] = tnet\n\t}\n\n\treturn ret, nil\n}\n\nfunc (c *LocalApiServerCfg) LoadCapiWhitelists() error {\n\tif c.CapiWhitelistsPath == \"\" {\n\t\treturn nil\n\t}\n\n\tlog.Warn(\"capi_whitelists_path is deprecated, please use centralized allowlists instead. See https://docs.crowdsec.net/docs/next/local_api/centralized_allowlists.\")\n\n\tfd, err := os.Open(c.CapiWhitelistsPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while opening capi whitelist file: %w\", err)\n\t}\n\n\tdefer fd.Close()\n\n\tc.CapiWhitelists, err = parseCapiWhitelists(fd)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while parsing capi whitelist file '%s': %w\", c.CapiWhitelistsPath, err)\n\t}\n\n\treturn nil\n}\n\nfunc (c *Config) LoadAPIClient() error {\n\tif c.API == nil || c.API.Client == nil || c.API.Client.CredentialsFilePath == \"\" || c.DisableAgent {\n\t\treturn errors.New(\"no API client section in configuration\")\n\t}\n\n\treturn c.API.Client.Load()","sourceCodeStart":481,"sourceCodeEnd":517,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L481-L517","documentation":"LoadCapiWhitelists opens the deprecated capi_whitelists_path file with os.Open before parsing. Any open failure (missing file, bad path, permissions) is wrapped with this prefix. The feature is deprecated in favor of centralized allowlists.","triggerScenarios":"config.yaml sets api.server.capi_whitelists_path to a path that does not exist or is not readable by the crowdsec process at LAPI startup.","commonSituations":"Stale capi_whitelists_path after moving config dirs; typo in path; file deleted by cleanup scripts; migrating setups where the whitelist file was never copied to the new host.","solutions":["Check the path in api.server.capi_whitelists_path exists (`ls -l`) and is readable","Remove capi_whitelists_path and migrate to centralized allowlists (`cscli allowlist`)","Fix the path typo or restore the whitelist file","Verify permissions for the crowdsec service user"],"exampleFix":"// before (config.yaml)\napi:\n  server:\n    capi_whitelists_path: /etc/crowdsec/capi_whitelists.yaml  # missing\n// after\n# remove the key entirely, use centralized allowlists:\n# cscli allowlists create ... / cscli allowlist ...","handlingStrategy":"validation","validationCode":"if path := cfg.API.Server.CapiWhitelistsPath; path != \"\" {\n\tif _, err := os.Stat(path); err != nil {\n\t\tlog.Fatalf(\"capi_whitelists_path %s unusable: %v\", path, err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := serverCfg.LoadCapiWhitelists(); err != nil {\n\tvar pe *os.PathError\n\tif errors.As(err, &pe) && errors.Is(pe.Err, fs.ErrNotExist) {\n\t\tlog.Warnf(\"whitelist file missing, skipping: %v\", pe)\n\t\treturn nil\n\t}\n\treturn err\n}","preventionTips":["Prefer centralized allowlists (`cscli allowlist`) over the deprecated file","Unset capi_whitelists_path when migrating hosts","Verify the path is readable by the service user before restart"],"tags":["config","whitelist","file","lapi","deprecated"],"backgroundTag":"file-open-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}