{"record":{"id":"97dc23cc7d9d40d1","repo":"phacility/phabricator","slug":"this-server-is-not-configured-to-serve-cluster-req","errorCode":null,"errorMessage":"This server is not configured to serve cluster requests. Set `cluster.addresses` in the configuration to whitelist cluster hosts before sending requests that use a cluster authentication mechanism.","messagePattern":"This server is not configured to serve cluster requests\\. Set `cluster\\.addresses` in the configuration to whitelist cluster hosts before sending requests that use a cluster authentication mechanism\\.","errorType":"exception","errorClass":"Exception","httpStatus":500,"severity":"error","filePath":"src/infrastructure/env/PhabricatorEnv.php","lineNumber":885,"sourceCode":"    if (!$cluster_addresses) {\n      return false;\n    }\n\n    $address = self::getRemoteAddress();\n    if (!$address) {\n      throw new Exception(\n        pht(\n          'Unable to test remote address against cluster whitelist: '.\n          'REMOTE_ADDR is not defined or not valid.'));\n    }\n\n    return self::isClusterAddress($address);\n  }\n\n  public static function isClusterAddress($address) {\n    $cluster_addresses = self::getEnvConfig('cluster.addresses');\n    if (!$cluster_addresses) {\n      throw new Exception(\n        pht(\n          'This server is not configured to serve cluster requests. '.\n          'Set `cluster.addresses` in the configuration to whitelist '.\n          'cluster hosts before sending requests that use a cluster '.\n          'authentication mechanism.'));\n    }\n\n    return PhutilCIDRList::newList($cluster_addresses)\n      ->containsAddress($address);\n  }\n\n  public static function getRemoteAddress() {\n    $address = idx($_SERVER, 'REMOTE_ADDR');\n    if (!$address) {\n      return null;\n    }\n\n    try {","sourceCodeStart":867,"sourceCodeEnd":903,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/infrastructure/env/PhabricatorEnv.php#L867-L903","documentation":"PhabricatorEnv::isClusterAddress($address) checks an address against the `cluster.addresses` CIDR whitelist via PhutilCIDRList. If that config is empty, there is no whitelist to test against, yet the caller is attempting a cluster-auth decision (e.g. verifying a request signed with a cluster token). Phabricator throws rather than returning false-with-no-config, forcing the operator to make the cluster boundary explicit - an unconfigured cluster must never silently authorize or under-authorize cluster traffic.","triggerScenarios":"A node receives a request using a cluster authentication mechanism (request signed by another node's cluster token, or any call to isClusterAddress()) while `cluster.addresses` is unset/empty - common when web nodes were cloned and one instance's config lacks the key.","commonSituations":"Scaling out from single-node to multi-node and forgetting to distribute cluster.addresses to every node; removing the config on one host during troubleshooting while the LB still routes cluster-authed traffic to it; git-based config drift across the fleet.","solutions":["Define the whitelist on every node: `./bin/config set cluster.addresses '[\"10.0.0.0/24\"]'` listing CIDRs covering all nodes' addresses as seen by each peer.","Verify each node sees the config: `./bin/config get cluster.addresses` per host; ensure config distribution (same local.json, same config pipeline) across the fleet.","If this install is genuinely single-node, stop sending cluster-authenticated requests to it (check the upstream node's configuration that is signing requests)."],"exampleFix":"# before: node receives cluster-authed request with no whitelist\nException: This server is not configured to serve cluster requests...\n\n# after: define the cluster CIDR on every node\n$ ./bin/config set cluster.addresses '[\"10.0.0.0/24\"]'\n$ ./bin/phd restart","handlingStrategy":"validation","validationCode":"if (!PhabricatorEnv::getEnvConfig('cluster.addresses')) {\n  throw new Exception(\n    'cluster.addresses must be configured before accepting cluster traffic.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  $ok = PhabricatorEnv::isClusterAddress($address);\n} catch (Exception $ex) {\n  // unconfigured cluster boundary: refuse cluster auth entirely\n  $ok = false;\n  phlog(pht('Cluster request rejected: %s', $ex->getMessage()));\n}","preventionTips":["Distribute identical cluster.addresses to every node via config management; drift here breaks auth.","Add a deploy pre-flight asserting the key is non-empty on all nodes of a clustered install.","Decide the cluster boundary (CIDR list) once and treat edits like firewall changes."],"tags":["phabricator","cluster","config","cidr","whitelist","security"],"backgroundTag":"cluster-whitelist-missing","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}