{"record":{"id":"718e0827132195b6","repo":"caddyserver/caddy","slug":"cache-capacity-must-be-0","errorCode":null,"errorMessage":"cache capacity must be >= 0","messagePattern":"cache capacity must be >= 0","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":394,"sourceCode":"\t\thostSet := make(map[string]int)\n\t\tfor i, ap := range t.Automation.Policies {\n\t\t\tif len(ap.subjects) == 0 {\n\t\t\t\tif hasDefault {\n\t\t\t\t\treturn fmt.Errorf(\"automation policy %d is the second policy that acts as default/catch-all, but will never be used\", i)\n\t\t\t\t}\n\t\t\t\thasDefault = true\n\t\t\t}\n\t\t\tfor _, h := range ap.subjects {\n\t\t\t\tif first, ok := hostSet[h]; ok {\n\t\t\t\t\treturn fmt.Errorf(\"automation policy %d: cannot apply more than one automation policy to host: %s (first match in policy %d)\", i, h, first)\n\t\t\t\t}\n\t\t\t\thostSet[h] = i\n\t\t\t}\n\t\t}\n\t}\n\tif t.Cache != nil {\n\t\tif t.Cache.Capacity < 0 {\n\t\t\treturn fmt.Errorf(\"cache capacity must be >= 0\")\n\t\t}\n\t}\n\treturn nil\n}\n\n// Start activates the TLS module.\nfunc (t *TLS) Start() error {\n\t// warn if on-demand TLS is enabled but no restrictions are in place\n\tif t.Automation.OnDemand == nil || (t.Automation.OnDemand.Ask == \"\" && t.Automation.OnDemand.permission == nil) {\n\t\tfor _, ap := range t.Automation.Policies {\n\t\t\tif ap.OnDemand && ap.isWildcardOrDefault() {\n\t\t\t\tif c := t.logger.Check(zapcore.WarnLevel, \"YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place\"); c != nil {\n\t\t\t\t\tc.Write(zap.String(\"docs\", \"https://caddyserver.com/docs/automatic-https#on-demand-tls\"))\n\t\t\t\t}\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":376,"sourceCodeEnd":412,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L376-L412","documentation":"tls.cache.capacity is the certificate cache size limit where 0 means unlimited and positive values bound the cache; negative values are meaningless. Validate() rejects a negative capacity outright.","triggerScenarios":"JSON config with {\"cache\": {\"capacity\": -10}} under the tls app; Caddyfile global option 'cert_cache -10'. Zero is allowed (unlimited), so any negative number is the trigger.","commonSituations":"Users attempting to 'disable' the cache with -1; arithmetic in generated configs producing negative numbers; misunderstanding that 0 already means unlimited.","solutions":["Set capacity to a positive number to bound the cache, or 0/omit for unlimited","If the intent was unlimited, just remove the cache block"],"exampleFix":"// before\n\"cache\": {\"capacity\": -1}\n// after\n\"cache\": {\"capacity\": 0}","handlingStrategy":"validation","validationCode":"if tlsApp.Cache != nil && tlsApp.Cache.Capacity < 0 {\n\treturn fmt.Errorf(\"cert cache capacity must be >= 0\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use 0 (or omit) for unlimited cache; positive to bound it","Never use negative numbers to express 'disabled'"],"tags":["caddy","tls","cache","validation","config"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}