{"record":{"id":"734cbf1cb5bd34ff","repo":"juanfont/headscale","slug":"oidc-client-secret-and-oidc-client-secret-path-are","errorCode":null,"errorMessage":"oidc_client_secret and oidc_client_secret_path are mutually exclusive","messagePattern":"oidc_client_secret and oidc_client_secret_path are mutually exclusive","errorType":"validation","errorClass":"errOidcMutuallyExclusive","httpStatus":null,"severity":"error","filePath":"hscontrol/types/config.go","lineNumber":35,"sourceCode":"\t\"github.com/rs/zerolog\"\n\t\"github.com/rs/zerolog/log\"\n\t\"github.com/spf13/viper\"\n\t\"go4.org/netipx\"\n\t\"tailscale.com/net/tsaddr\"\n\t\"tailscale.com/tailcfg\"\n\t\"tailscale.com/types/dnstype\"\n\t\"tailscale.com/util/set\"\n)\n\nconst (\n\tPKCEMethodPlain string = \"plain\"\n\tPKCEMethodS256  string = \"S256\"\n\n\tdefaultNodeStoreBatchSize = 100\n)\n\nvar (\n\terrOidcMutuallyExclusive     = errors.New(\"oidc_client_secret and oidc_client_secret_path are mutually exclusive\")\n\terrOIDCIssuerInvalid         = errors.New(\"oidc.issuer must be a valid http(s) URL\")\n\terrOIDCClientIDRequired      = errors.New(\"oidc.client_id is required when oidc.issuer is set\")\n\terrOIDCClientSecretRequired  = errors.New(\"oidc.client_secret or oidc.client_secret_path is required when oidc.issuer is set\")\n\terrServerURLSuffix           = errors.New(\"server_url cannot be part of base_domain in a way that could make the DERP and headscale server unreachable\")\n\terrServerURLSame             = errors.New(\"server_url cannot use the same domain as base_domain in a way that could make the DERP and headscale server unreachable\")\n\terrInvalidPKCEMethod         = errors.New(\"pkce.method must be either 'plain' or 'S256'\")\n\terrTrustedProxyZeroRange     = errors.New(\"0.0.0.0/0 and ::/0 are not allowed\")\n\tErrNoPrefixConfigured        = errors.New(\"no IPv4 or IPv6 prefix configured, minimum one prefix is required\")\n\tErrInvalidAllocationStrategy = errors.New(\"invalid prefix allocation strategy\")\n)\n\ntype IPAllocationStrategy string\n\nconst (\n\tIPAllocationStrategySequential IPAllocationStrategy = \"sequential\"\n\tIPAllocationStrategyRandom     IPAllocationStrategy = \"random\"\n)\n","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/types/config.go#L17-L53","documentation":"errOidcMutuallyExclusive is an unexported config validation error in hscontrol/types/config.go:35 returned at config.go:1189 when both oidc_client_secret and oidc_client_secret_path are set at once. Headscale refuses the ambiguity of two secret sources; exactly one must be provided (see also errOIDCClientSecretRequired for the neither-set case).","triggerScenarios":"A config file (or environment overrides) setting both oidc.client_secret and oidc.client_secret_path; templated configs that inject the inline secret while also mounting a secret file path.","commonSituations":"Migrating from inline secrets to file-based secrets and forgetting to remove the old key; Helm/Nix templates defaulting both keys; environment variable plus config file both defining the secret.","solutions":["Keep exactly one source: remove oidc_client_secret and keep oidc_client_secret_path (preferred for secrets)","Or remove oidc_client_secret_path and keep the inline value only in non-production setups","Check environment-variable overrides (viper merges env) for a second definition","Restart headscale after correcting the config"],"exampleFix":"# before\noidc:\n  client_secret: my-secret\n  client_secret_path: /run/secrets/oidc\n\n# after\noidc:\n  client_secret_path: /run/secrets/oidc","handlingStrategy":"validation","validationCode":"if cfg.OIDC.ClientSecret != \"\" && cfg.OIDC.ClientSecretPath != \"\" {\n    return errors.New(\"set only one of client_secret / client_secret_path\")\n}","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Prefer file-based secrets and delete inline keys when migrating","Lint configs in CI for double-defined OIDC secret keys"],"tags":["headscale","config","oidc","secrets"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}