{"record":{"id":"40f3fd185e7f6372","repo":"infiniflow/ragflow","slug":"no-private-key","errorCode":null,"errorMessage":"No private key","messagePattern":"No private key","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"common/config_utils.py","lineNumber":128,"sourceCode":"\ndef get_base_config(key, default=None):\n    if key is None:\n        return None\n    if default is None:\n        default = os.environ.get(key.upper())\n    return CONFIGS.get(key, default)\n\n\ndef decrypt_database_password(password):\n    encrypt_password = get_base_config(\"encrypt_password\", False)\n    encrypt_module = get_base_config(\"encrypt_module\", False)\n    private_key = get_base_config(\"private_key\", None)\n\n    if not password or not encrypt_password:\n        return password\n\n    if not private_key:\n        raise ValueError(\"No private key\")\n\n    module_fun = encrypt_module.split(\"#\")\n    pwdecrypt_fun = getattr(importlib.import_module(module_fun[0]), module_fun[1])\n\n    return pwdecrypt_fun(private_key, password)\n\n\ndef decrypt_database_config(database=None, passwd_key=\"password\", name=\"database\"):\n    if not database:\n        database = get_base_config(name, {})\n\n    database[passwd_key] = decrypt_database_password(database[passwd_key])\n    return database\n\n\ndef update_config(key, value, conf_name=SERVICE_CONF):\n    conf_path = conf_realpath(conf_name=conf_name)\n    if not os.path.isabs(conf_path):","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/infiniflow/ragflow/blob/554fb1133ac3861732235ad9c377eb5e0a770665/common/config_utils.py#L110-L146","documentation":"ValueError raised by decrypt_database_password in common/config_utils.py:113-133. When the service config enables password encryption (encrypt_password: true in service_conf.yaml), database passwords stored in the config are expected to be ciphertext decrypted with a private key configured at base.private_key. If encrypt_password is on but private_key is missing/null, decryption cannot proceed and the loader refuses to continue with a vague 'No private key' error.","triggerScenarios":"service_conf.yaml (or local.service_conf.yaml) sets encrypt_password: true and supplies an encrypted mysql/password value, but private_key is absent or null. Fires during decrypt_database_config at startup when the DB connection settings are prepared.","commonSituations":"Copying a production-style config that enables encryption without copying the key; rotating keys and forgetting to update private_key; enabling encrypt_password as an experiment and leaving it on; the key living in a different config stanza than expected.","solutions":["Add base.private_key to service_conf.yaml pointing at (or containing) the RSA private key used to encrypt the password.","If you do not actually use encrypted passwords, set encrypt_password: false and store the plaintext DB password (or use environment variables) instead.","Ensure encrypt_module is also set correctly (module#function) — it is required in the very next line once the key check passes."],"exampleFix":"# before (service_conf.yaml)\nencrypt_password: true\n# no private_key\n# after\nencrypt_password: true\nprivate_key: \"-----BEGIN RSA PRIVATE KEY-----...\"\n# or, if not using encryption:\n# encrypt_password: false","handlingStrategy":"validation","validationCode":"from common.config_utils import get_base_config\nif get_base_config(\"encrypt_password\", False) and not get_base_config(\"private_key\", None):\n    raise RuntimeError(\"encrypt_password is enabled but private_key is missing — refusing to start\")","typeGuard":null,"tryCatchPattern":"try:\n    decrypt_database_config()\nexcept ValueError as e:\n    if str(e) == \"No private key\":\n        # fail fast with an operator-actionable message about base.private_key\n        raise RuntimeError(\"Set base.private_key or disable encrypt_password in service_conf.yaml\") from e\n    raise","preventionTips":["If you enable encrypt_password, store private_key in the same change/commit.","Keep encryption settings and key together in local.service_conf.yaml (git-ignored).","Add a startup assertion pairing encrypt_password with private_key."],"tags":["config","secrets","database","startup","encryption"],"backgroundTag":null,"analyzedSha":"554fb1133ac3861732235ad9c377eb5e0a770665","analyzedAt":"2026-08-15T09:20:16.380Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}