{"record":{"id":"8676b9e93678fdb9","repo":"juanfont/headscale","slug":"autogroup-not-supported-in-headscale","errorCode":null,"errorMessage":"autogroup not supported in headscale","messagePattern":"autogroup not supported in headscale","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"info","filePath":"hscontrol/policy/v2/types.go","lineNumber":134,"sourceCode":"\tErrInvalidAutogroup            = errors.New(\"invalid autogroup\")\n\tErrUnknownAutogroup            = errors.New(\"unknown autogroup\")\n\tErrHostportMissingColon        = errors.New(\"hostport must contain a colon\")\n\tErrTypeNotSupported            = errors.New(\"type not supported\")\n\tErrInvalidAlias                = errors.New(\"invalid alias format\")\n\tErrInvalidAutoApprover         = errors.New(\"invalid auto approver format\")\n\tErrInvalidOwner                = errors.New(\"invalid owner format\")\n\tErrGroupNotDefined             = errors.New(\"group not defined in policy\")\n\tErrInvalidGroupMember          = errors.New(\"invalid group member type\")\n\tErrGroupValueNotArray          = errors.New(\"group value must be an array of users\")\n\tErrInvalidHostIP               = errors.New(\"hostname contains invalid IP address\")\n\tErrTagNotDefined               = errors.New(\"tag not found\")\n\tErrAutoApproverNotAlias        = errors.New(\"auto approver is not an alias\")\n\tErrInvalidACLAction            = errors.New(\"invalid ACL action\")\n\tErrInvalidSSHAction            = errors.New(\"invalid SSH action\")\n\tErrInvalidProtocolNumber       = errors.New(\"invalid protocol number\")\n\tErrProtocolLeadingZero         = errors.New(\"leading 0 not permitted in protocol number\")\n\tErrProtocolOutOfRange          = errors.New(\"protocol number out of range (0-255)\")\n\tErrAutogroupNotSupported       = errors.New(\"autogroup not supported in headscale\")\n\tErrAutogroupInternetSrc        = errors.New(\"autogroup:internet can only be used in ACL destinations\")\n\tErrAutogroupSelfSrc            = errors.New(\"\\\"autogroup:self\\\" not valid on the src side of a rule\")\n\tErrAutogroupNotSupportedACLSrc = errors.New(\"autogroup not supported for ACL sources\")\n\tErrAutogroupNotSupportedACLDst = errors.New(\"autogroup not supported for ACL destinations\")\n\tErrAutogroupDangerAllDst       = errors.New(\"cannot use autogroup:danger-all as a dst\")\n\tErrAutogroupNotSupportedSSHSrc = errors.New(\"autogroup not supported for SSH sources\")\n\tErrAutogroupNotSupportedSSHDst = errors.New(\"autogroup not supported for SSH destinations\")\n\tErrHostNotDefined              = errors.New(\"host not defined in policy\")\n\tErrSSHSourceAliasNotSupported  = errors.New(\"alias not supported for SSH source\")\n\tErrSSHDestAliasNotSupported    = errors.New(\"alias not supported for SSH destination\")\n\tErrUnknownField                = errors.New(\"unknown field\")\n\tErrProtocolNoSpecificPorts     = errors.New(\"protocol does not support specific ports\")\n\tErrTestEmptyAssertions         = errors.New(\"test entry must have at least one of \\\"accept\\\" or \\\"deny\\\"\")\n\tErrTestProtocolNotAllowed      = errors.New(\"test protocol must be tcp, udp, sctp, or empty\")\n\tErrTestDestinationMultiPort    = errors.New(\"test destination port must be a single port\")\n\tErrTestDestinationCIDR         = errors.New(\"test destination must be a single host, not a CIDR range\")\n\tErrAutogroupInternetTestDst    = errors.New(\"autogroup:internet not valid as a test destination\")\n\tErrSSHTestEmptySrc             = errors.New(\"SSH tests entry must have a non-empty src\")","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/types.go#L116-L152","documentation":"Returned by validateAutogroupSupported (hscontrol/policy/v2/types.go:2026) when an autogroup appears in the autogroupNotSupported deny-list. That list is currently EMPTY (types.go:2003: autogroupNotSupported = []AutoGroup{}), so this error is unreachable with the current codebase — it is a reserved hook for autogroups headscale may refuse to implement later.","triggerScenarios":"Cannot be triggered by any policy today. Would fire if a future headscale release added an autogroup to autogroupNotSupported and a policy used it in an ACL src/dst or SSH position that routes through validateAutogroupSupported.","commonSituations":"Grep/error-catalog work: finding this sentinel with no call path producing it. Users seeing an 'autogroup not supported in headscale' message are most likely on a different headscale version or hitting a different autogroup error.","solutions":["If you see this message at runtime, check which autogroup is named and consult the headscale release notes for newly unsupported autogroups","Replace the unsupported autogroup with an explicit group, tag, or user list","Upgrade or pin headscale to a version whose autogroup support matches your policy"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isAutogroupNotSupported(err error) bool {\n\treturn errors.Is(err, policy.ErrAutogroupNotSupported)\n}","tryCatchPattern":"if err := p.Validate(); err != nil {\n\tif errors.Is(err, policy.ErrAutogroupNotSupported) {\n\t\t// currently unreachable (deny-list empty); treat as version mismatch\n\t\treturn fmt.Errorf(\"autogroup unsupported in this headscale build: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Pin the headscale version in deployment so autogroup support is predictable","Prefer explicit groups/tags over exotic autogroups in long-lived policies","Read release notes before adopting new autogroup: values"],"tags":["policy","autogroup","dead-code","sentinel"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}