{"record":{"id":"8f7bd4781467cee0","repo":"block/buzz","slug":"failed-to-backfill-pubkey-allowlist-required-when","errorCode":null,"errorMessage":"Failed to backfill pubkey_allowlist (required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true): {e}","messagePattern":"Failed to backfill pubkey_allowlist \\(required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true\\): (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/buzz-relay/src/main.rs","lineNumber":397,"sourceCode":"                }\n            }\n        }\n    };\n\n    // NIP-43: migrate any existing pubkey_allowlist entries to relay_members.\n    // Idempotent — safe to run every startup. Must run before bootstrap_owner\n    // so that existing allowlist users become relay members before the owner\n    // is promoted (otherwise enabling membership locks everyone out).\n    if let Some(community) = deployment_community {\n        match db.backfill_from_allowlist(community).await {\n            Ok(0) => {}\n            Ok(n) => info!(\"Backfilled {n} pubkey_allowlist entries into relay_members\"),\n            Err(e) => {\n                if config.require_relay_membership {\n                    error!(\n                        \"Fatal: failed to backfill allowlist with membership enforcement enabled: {e}\"\n                    );\n                    return Err(anyhow::anyhow!(\n                        \"Failed to backfill pubkey_allowlist (required when BUZZ_REQUIRE_RELAY_MEMBERSHIP=true): {e}\"\n                    ));\n                } else {\n                    error!(\"Failed to backfill pubkey_allowlist (non-fatal): {e}\");\n                }\n            }\n        }\n    }\n\n    // NIP-43: ensure the configured relay owner always holds the owner role\n    // within the deployment community.\n    if let (Some(community), Some(owner_pubkey)) =\n        (deployment_community, config.relay_owner_pubkey.as_ref())\n    {\n        match db.bootstrap_owner(community, owner_pubkey).await {\n            Ok(()) => info!(pubkey = %owner_pubkey, \"Relay owner bootstrapped\"),\n            Err(e) => {\n                if config.require_relay_membership {","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/block/buzz/blob/ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be/crates/buzz-relay/src/main.rs#L379-L415","documentation":"Fatal startup error: db.backfill_from_allowlist(community) — the idempotent migration of existing pubkey_allowlist entries into relay_members — failed while BUZZ_REQUIRE_RELAY_MEMBERSHIP=true. It runs before owner bootstrap precisely so existing allowlisted users keep access when enforcement turns on; failing here means startup must not continue.","triggerScenarios":"DB error during the backfill write: connectivity blip, insufficient privileges on the allowlist/relay_members tables, or schema drift where the pubkey_allowlist table does not exist (migrations not applied) on a deployment that has allowlist data elsewhere.","commonSituations":"Enabling membership enforcement on a long-running relay that used an allowlist; least-privilege DB role missing rights on the newly-written table; DB failover mid-boot.","solutions":["Inspect {e}: Ok variants matter — this error path is only Err, so identify the SQL failure","Ensure migrations are applied so both pubkey_allowlist and relay_members exist with expected columns","Grant the relay DB user the needed read/write on those tables, then restart","If transient, restart once Postgres is healthy — the backfill is idempotent and safe to re-run"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# Confirm both tables exist before enabling enforcement:\npsql \"$DATABASE_URL\" -c '\\dt' | grep -E 'pubkey_allowlist|relay_members'","typeGuard":null,"tryCatchPattern":"// Retry startup with backoff for transient DB errors; stop and fix grants/\n// migrations when {e} indicates permission denied or undefined relation.","preventionTips":["Apply migrations before turning on BUZZ_REQUIRE_RELAY_MEMBERSHIP","The backfill is idempotent — restarting after the DB is healthy is always safe","Alert on this error during enforcement rollout; it blocks owner bootstrap that follows"],"tags":["postgres","backfill","nip-43","allowlist","startup","buzz-relay"],"backgroundTag":"database-write-failed","analyzedSha":"ef2aa1ae38fadcc0bc22b8bf6ed96b35933146be","analyzedAt":"2026-08-20T04:38:24.874Z","contentChangedAt":"2026-08-20T04:38:24.874Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}