{"record":{"id":"4afa24ca8a573338","repo":"nextcloud/all-in-one","slug":"could-not-reach-the-desec-api-message","errorCode":null,"errorMessage":"Could not reach the deSEC API: {message}","messagePattern":"Could not reach the deSEC API: (.+?)","errorType":"exception","errorClass":"\\Exception","httpStatus":422,"severity":"error","filePath":"php/src/Desec/DesecManager.php","lineNumber":200,"sourceCode":"    /**\n     * Requests creation of a new deSEC account.\n     *\n     * deSEC replies 202 Accepted and emails a verification link; no API token is\n     * returned here and the account is unusable until the email is verified. For\n     * privacy reasons deSEC also returns 202 when the email is already registered\n     * (without sending a mail), so a 202 cannot be treated as proof of a new account.\n     * The captcha field is omitted; deSEC requires it only at email-verification time,\n     * which the user completes in the browser via the emailed link.\n     *\n     * @throws \\Exception on network failure or an unexpected HTTP response\n     */\n    public function registerAccount(string $email, string $password): void {\n        try {\n            $res = $this->guzzleClient->post($this->configurationManager->desecApiBase . '/auth/', [\n                'json' => ['email' => $email, 'password' => $password],\n            ]);\n        } catch (TransferException $e) {\n            throw new \\Exception('Could not reach the deSEC API: ' . $e->getMessage());\n        }\n\n        $code = $res->getStatusCode();\n\n        if ($code !== 202) {\n            throw new \\Exception('Unexpected response from deSEC during account registration (HTTP ' . $code . '): ' . $res->getBody()->getContents());\n        }\n    }\n\n    /**\n     * Attempts to log in after the user was asked to verify a freshly created account.\n     *\n     * A login failure here has two common causes that we cannot tell apart, because\n     * deSEC returns 202 both for a genuinely new account and for one whose email was\n     * already registered (to prevent email enumeration):\n     *   1. The account is new but its email has not been verified yet.\n     *   2. The email already belonged to an existing deSEC account, so no new account\n     *      (and no verification mail) was created and our generated password is wrong.","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Desec/DesecManager.php#L182-L218","documentation":"Thrown by DesecManager::registerAccount when the Guzzle POST to {desecApiBase}/auth/ raises a TransferException, i.e. DNS resolution failure, connection refused/timeout, TLS error, or a transport-level problem. HTTP error statuses (4xx/5xx) from deSEC surface through a different code path, so this message specifically means the API could not be reached at all.","triggerScenarios":"registerAccount() runs while the mastercontainer has no working internet egress: desec.io DNS fails, outbound 443 blocked by firewall, proxy misconfigured (missing HTTP(S)_PROXY env), TLS interception with an untrusted CA, or IPv6-only broken connectivity.","commonSituations":"Homelab behind a restrictive firewall or Pi-hole blocklist blocking desec.io; corporate TLS-inspecting proxy whose CA is not in the container trust store; transient deSEC outage; container DNS misconfigured after Docker network changes.","solutions":["From the host/container verify reachability: `curl -v https://desec.io/api/v1/auth/` and check DNS/firewall for desec.io on port 443.","If a proxy is required, pass it via the mastercontainer environment and make sure the container trusts the proxy's CA certificate.","Retry after a transient outage; check https://status.desec.io for deSEC-side incidents.","If egress is permanently restricted, use a manual deSEC account and configure DNS without the built-in registration flow."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight reachability before driving the deSEC flow\n$res = @$guzzleClient->request('GET', $configurationManager->desecApiBase);\nif (!isset($res) || $res->getStatusCode() >= 500) {\n    // defer registration until connectivity is confirmed\n}","typeGuard":null,"tryCatchPattern":"use GuzzleHttp\\Exception\\TransferException;\n\ntry {\n    $desecManager->registerAccount($email, $password);\n} catch (TransferException $e) {\n    // network-level failure (DNS/firewall/TLS): safe to retry with backoff\n} catch (\\Exception $e) {\n    // API-level or validation outcome: inspect message, do not blind-retry\n}","preventionTips":["Allow outbound HTTPS to desec.io from the AIO network before starting the wizard.","Configure proxy env vars and trusted CAs for TLS-inspecting networks.","Wrap registerAccount in bounded exponential-backoff retries for transient outages."],"tags":["php","nextcloud-aio","desec","network","dns","api","guzzle"],"backgroundTag":"api-unreachable","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}