{"record":{"id":"a35d9f09fb264f99","repo":"hashicorp/nomad","slug":"http-max-conns-per-client-must-be-0","errorCode":null,"errorMessage":"http_max_conns_per_client must be >= 0","messagePattern":"http_max_conns_per_client must be >= 0","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"command/agent/http.go","lineNumber":144,"sourceCode":"\t\tserverInitializationErrors error\n\t\tconnCount                  atomic.Int32\n\t)\n\n\t// Get connection handshake timeout limit\n\thandshakeTimeout, err := time.ParseDuration(config.Limits.HTTPSHandshakeTimeout)\n\tif err != nil {\n\t\treturn srvs, fmt.Errorf(\"error parsing https_handshake_timeout: %v\", err)\n\t} else if handshakeTimeout < 0 {\n\t\treturn srvs, fmt.Errorf(\"https_handshake_timeout must be >= 0\")\n\t}\n\n\t// Get max connection limit\n\tmaxConns := 0\n\tif mc := config.Limits.HTTPMaxConnsPerClient; mc != nil {\n\t\tmaxConns = *mc\n\t}\n\tif maxConns < 0 {\n\t\treturn srvs, fmt.Errorf(\"http_max_conns_per_client must be >= 0\")\n\t}\n\n\ttlsConf, err := tlsutil.NewTLSConfiguration(config.TLSConfig, config.TLSConfig.VerifyHTTPSClient, true)\n\tif err != nil && config.TLSConfig.EnableHTTP {\n\t\treturn srvs, fmt.Errorf(\"failed to initialize HTTP server TLS configuration: %s\", err)\n\t}\n\n\twsUpgrader := &websocket.Upgrader{\n\t\tReadBufferSize:  2048,\n\t\tWriteBufferSize: 2048,\n\t\tSubprotocols:    []string{websocketProtocolWatcher},\n\t}\n\n\t// If running in dev mode and the option to disable the websocket origin check is unset\n\t// then disable the origin check. Otherwise, only disable if it has been explicitly set\n\t// in the configuration. Disabling of the origin check is useful when doing UI development\n\t// and using the ember proxy to reach an agent in dev mode or a local cluster.\n\tif (config.DevMode && config.HTTPDisableWebSocketOriginCheck == nil) ||","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/command/agent/http.go#L126-L162","documentation":"Returned by NewHTTPServers (command/agent/http.go:144) when `limits.http_max_conns_per_client` is set to a negative integer. The per-client HTTP connection cap must be zero or positive (0 meaning unlimited), so a negative value aborts HTTP server startup.","triggerScenarios":"Configuring `limits { http_max_conns_per_client = -1 }` — the '-1 means unlimited' idiom from other software — and starting or reloading the Nomad agent.","commonSituations":"Carrying over -1 = unlimited conventions from nginx etc.; automation scripts substituting -1 as an 'unset' sentinel; sign typos when hand-editing config.","solutions":["Set http_max_conns_per_client to 0 for unlimited or a positive integer for a cap.","Remove the setting entirely to accept defaults.","Fix automation that substitutes -1 as an unset sentinel.","Run `nomad validate` before deploying the config."],"exampleFix":"// before (HCL)\nlimits {\n  http_max_conns_per_client = -1\n}\n// after\nlimits {\n  http_max_conns_per_client = 0\n}","handlingStrategy":"validation","validationCode":"if mc := cfg.Limits.HTTPMaxConnsPerClient; mc != nil && *mc < 0 {\n    return fmt.Errorf(\"http_max_conns_per_client must be >= 0\")\n}","typeGuard":"func validMaxConns(v *int) bool {\n    return v == nil || *v >= 0\n}","tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"http_max_conns_per_client must be >= 0\") {\n        // set to 0 (unlimited) or a positive cap and re-run setup\n    }\n}","preventionTips":["Use 0 for unlimited, never -1 (unlike nginx conventions).","Clamp generated values to >= 0 in automation.","Run `nomad validate` before deploys."],"tags":["configuration","validation","limits","nomad"],"backgroundTag":"invalid-config-value","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}