{"record":{"id":"723a8c7af4919268","repo":"netbirdio/netbird","slug":"tun-module-not-available","errorCode":null,"errorMessage":"tun module not available","messagePattern":"tun module not available","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/iface/iface_new_linux.go","lineNumber":41,"sourceCode":"\t}\n\n\tif device.WireGuardModuleIsLoaded() {\n\t\treturn &WGIface{\n\t\t\ttun:            device.NewKernelDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, opts.TransportNet),\n\t\t\twgProxyFactory: wgproxy.NewKernelFactory(opts.WGPort, opts.MTU),\n\t\t}, nil\n\t}\n\n\tif device.ModuleTunIsLoaded() {\n\t\ticeBind := bind.NewICEBind(opts.TransportNet, opts.Address, opts.MTU)\n\t\treturn &WGIface{\n\t\t\ttun:            device.NewTunDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind),\n\t\t\tuserspaceBind:  true,\n\t\t\twgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),\n\t\t}, nil\n\t}\n\n\treturn nil, errors.New(\"tun module not available\")\n}\n","sourceCodeStart":23,"sourceCodeEnd":43,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/iface/iface_new_linux.go#L23-L43","documentation":"handleHeaderAuthError (middleware.go:498) fires when a header scheme's Authenticate returned ErrHeaderAuthFailed, meaning the presented header credentials were syntactically processable but authentication failed (e.g. wrong username/password or bad credential header per the scheme). This is a clean 401, distinct from infrastructure errors at the same helper which produce 502.","triggerScenarios":"A request whose header scheme trigger is present (the header the scheme watches) with credentials that fail validation — wrong value, wrong format for the scheme, credentials for a different operator/user, or a basic-auth pair that does not match.","commonSituations":"API key or password rotated and the client still sends the old one; typo in the header name causing an unintended scheme to consume the request; CI secret expired; user account behind the credentials disabled in management.","solutions":["Verify the exact header name and credential format the domain's header scheme expects (values are compared as the scheme defines, not as a generic bearer token).","Rotate/refresh the credential on the client and retry.","Confirm the operator account backing the credential is still active in management.","Check that only one scheme is registered for the domain if headers could collide between schemes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before calling: confirm the credential is present and matches the scheme's\n// expected header format exactly.\nif v := strings.TrimSpace(os.Getenv(\"NB_HEADER_CRED\")); v == \"\" {\n    return errors.New(\"header credential missing: set NB_HEADER_CRED\")\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Do(req)\nif err == nil && resp.StatusCode == http.StatusUnauthorized {\n    // Header credentials rejected (not infrastructure): rotate the secret,\n    // verify header name/format against the domain's scheme, retry once.\n}","preventionTips":["Pin the exact header name and value format the domain's header scheme defines.","Rotate credentials before expiry and update all clients atomically.","Distinguish 401 (credentials wrong) from 502 (backend down) before touching secrets.","Avoid registering colliding header schemes on the same domain."],"tags":["proxy","header-auth","authentication","http"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}