{"record":{"id":"60761963e75bc3dc","repo":"crowdsecurity/crowdsec","slug":"plugins-are-enabled-but-the-plugin-config-section","errorCode":null,"errorMessage":"plugins are enabled, but the plugin_config section is missing in the configuration","messagePattern":"plugins are enabled, but the plugin_config section is missing in the configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apiserver.go","lineNumber":526,"sourceCode":"\ts.controller.PluginChannel = broker.PluginChannel\n}\n\nfunc hasPlugins(profiles []*csconfig.ProfileCfg) bool {\n\tfor _, profile := range profiles {\n\t\tif len(profile.Notifications) != 0 {\n\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n\nfunc (s *APIServer) InitPlugins(ctx context.Context, cConfig *csconfig.Config, pluginBroker *csplugin.PluginBroker) error {\n\tif hasPlugins(s.cfg.Profiles) {\n\t\tlog.Info(\"initiating plugin broker\")\n\t\t// On windows, the plugins are always run as medium-integrity processes, so we don't care about plugin_config\n\t\tif cConfig.PluginConfig == nil && runtime.GOOS != \"windows\" {\n\t\t\treturn errors.New(\"plugins are enabled, but the plugin_config section is missing in the configuration\")\n\t\t}\n\n\t\tif cConfig.ConfigPaths.PluginDir == \"\" {\n\t\t\treturn errors.New(\"plugins are enabled, but config_paths.plugin_dir is not defined\")\n\t\t}\n\n\t\terr := pluginBroker.Init(ctx, cConfig.PluginConfig, s.cfg.Profiles, cConfig.ConfigPaths)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"plugin broker: %w\", err)\n\t\t}\n\n\t\tlog.Info(\"initiated plugin broker\")\n\t\ts.AttachPluginBroker(pluginBroker)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":508,"sourceCodeEnd":544,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apiserver.go#L508-L544","documentation":"InitPlugins detects notification plugins referenced by profiles, which requires the plugin broker to know how to spawn plugin processes (user/group, etc.). That configuration lives in the plugin_config section; if it's absent (and the OS is not Windows, where it's unnecessary) initialization fails.","triggerScenarios":"api.server.profiles reference notification plugins (e.g. notification/email) while config.yaml lacks the plugin_config: section; usually after hand-writing a minimal config or an incomplete upgrade.","commonSituations":"Freshly assembled config files copied from docs that omit plugin_config; container images with trimmed configs; disabling plugin_config while still having profiles with notifications.","solutions":["Add a plugin_config section to config.yaml, e.g. plugin_config: { user: crowdsec, group: crowdsec }.","Remove/disable the notification entries in api.server.profiles if plugins are not actually needed.","On containers, ensure the packaged default config includes plugin_config rather than a hand-minimal one."],"exampleFix":"# before\n# (no plugin_config section in config.yaml)\n# after\nplugin_config:\n  user: crowdsec\n  group: crowdsec","handlingStrategy":"validation","validationCode":"if len(cfg.API.Server.Profiles) > 0 && cfg.PluginConfig == nil {\n    return errors.New(\"profiles use plugins but plugin_config is missing\")\n}","typeGuard":null,"tryCatchPattern":"if err := server.InitPlugins(ctx, cfg, broker); err != nil {\n    log.Fatalf(\"plugin init: %v\", err)\n}","preventionTips":["Base custom configs on the stock config.yaml, which includes plugin_config.","Validate config with `crowdsec -t` after edits.","Strip notification profiles if you intentionally run without plugins."],"tags":["plugins","configuration","lapi"],"backgroundTag":"missing-required-config","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}