{"record":{"id":"675656093518ee38","repo":"hcengineering/platform","slug":"server-secret-must-be-provided-for-secure-confgiur","errorCode":null,"errorMessage":"server secret must be provided for secure confgiuration","messagePattern":"server secret must be provided for secure confgiuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"foundations/stream/internal/pkg/config/config.go","lineNumber":69,"sourceCode":"\n// FromEnv creates new Config from env\nfunc FromEnv() (*Config, error) {\n\tvar result Config\n\n\tif err := envconfig.Usage(\"stream\", &result); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err := envconfig.Process(\"stream\", &result); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif *result.EndpointURL == (url.URL{}) {\n\t\tresult.EndpointURL = nil\n\t}\n\n\tif !result.Insecure && result.ServerSecret == \"\" {\n\t\treturn nil, errors.New(\"server secret must be provided for secure confgiuration\")\n\t}\n\n\treturn &result, nil\n}\n\n// Endpoint returns upload address\nfunc (c *Config) Endpoint() *url.URL {\n\tvar scheme = \"https\"\n\tif c.Insecure {\n\t\tscheme = \"http\"\n\t}\n\treturn &url.URL{\n\t\tScheme: scheme,\n\t\tHost:   c.EndpointURL.Host,\n\t}\n}\n","sourceCodeStart":51,"sourceCodeEnd":86,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/stream/internal/pkg/config/config.go#L51-L86","documentation":"The stream service's config loader (FromEnv) rejects configurations where TLS is enabled (Insecure is false) but no ServerSecret was provided. The secret is required to authenticate the upload endpoint in secure mode. Note the message contains a typo ('confgiuration') which is how it usually appears in logs.","triggerScenarios":"Starting the service with INSECURE=false (or unset, defaulting to secure) while the server-secret env var is empty or missing; FromEnv called from cfg at startup with partial environment.","commonSituations":"Deploying without setting the secret env var; copying a dev compose file that only sets the endpoint URL; rotating secrets and leaving the variable blank; running locally with secure defaults assumed.","solutions":["Set the server secret environment variable expected by FromEnv before starting the service","Or explicitly enable insecure mode (set the INSECURE flag) for local/non-production environments — not recommended for production","Verify with the deployment manifest (env section) that the secret is injected, not an empty string","Fix config plumbing so the secret from the secret manager is actually mapped to the expected env var name"],"exampleFix":"// before\nSTREAM_ENDPOINT_URL=https://stream.example.com\n# secret missing\n// after\nSTREAM_ENDPOINT_URL=https://stream.example.com\nSTREAM_SERVER_SECRET=<secret-value>","handlingStrategy":"validation","validationCode":"if os.Getenv(\"STREAM_INSECURE\") != \"true\" && os.Getenv(\"STREAM_SERVER_SECRET\") == \"\" {\n    panic(\"STREAM_SERVER_SECRET must be set when secure mode is enabled\")\n}","typeGuard":null,"tryCatchPattern":"cfg, err := config.FromEnv()\nif err != nil {\n    log.Fatalf(\"stream config: %v\", err) // fails fast at startup\n}","preventionTips":["Fail fast at deploy time: validate required env vars in CI/startup scripts","Document every env var the stream service reads","Never leave secret env vars set to empty strings in manifests","Use secure mode explicitly; set INSECURE only for local dev"],"tags":["config","env","tls","startup"],"backgroundTag":"missing-env-var","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}