{"record":{"id":"a40f4486a40d7184","repo":"gastownhall/beads","slug":"proxied-server-external-v","errorCode":null,"errorMessage":"--proxied-server-external-*: %v","messagePattern":"--proxied-server-external-\\*: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/bd/init.go","lineNumber":529,"sourceCode":"\t\t\treturn fmt.Errorf(\"--debug cannot be combined with --proxied-server-external-* (debug applies to the managed dolt sql-server only)\")\n\t\t}\n\t\tvar externalConfig *configfile.ExternalDoltConfig\n\t\tif externalProvided {\n\t\t\tcfg := configfile.ExternalDoltConfig{\n\t\t\t\tHost:            externalHost,\n\t\t\t\tPort:            externalPort,\n\t\t\t\tSocket:          externalSocketPath,\n\t\t\t\tUser:            externalUser,\n\t\t\t\tTLSRequired:     externalTLS,\n\t\t\t\tTLSCACert:       externalTLSCACertPath,\n\t\t\t\tTLSCert:         externalTLSCertPath,\n\t\t\t\tTLSKey:          externalTLSKeyPath,\n\t\t\t\tTLSServerName:   externalTLSServerName,\n\t\t\t\tTLSSkipVerify:   externalTLSSkipVerify,\n\t\t\t\tKeepAlivePeriod: externalKeepAlive,\n\t\t\t}\n\t\t\tif err := cfg.Validate(); err != nil {\n\t\t\t\treturn fmt.Errorf(\"--proxied-server-external-*: %v\", err)\n\t\t\t}\n\t\t\texternalConfig = &cfg\n\t\t}\n\n\t\t// Backend selection: Dolt is the only supported backend.\n\t\tif !configfile.IsSupportedBackend(backendFlag) {\n\t\t\tswitch backendFlag {\n\t\t\tcase configfile.BackendPostgres, configfile.BackendMySQL:\n\t\t\t\treturn fmt.Errorf(\"storage backend %q is no longer supported: %s; the supported backend is \\\"dolt\\\" (default)\", backendFlag, configfile.RemovedBackendRationale)\n\t\t\tcase configfile.BackendSQLite:\n\t\t\t\treturn fmt.Errorf(\"storage backend %q is no longer supported: %s; the supported backend is \\\"dolt\\\" (default)\", backendFlag, configfile.RemovedSQLiteRationale)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unknown backend %q: the supported backend is \\\"dolt\\\" (default)\", backendFlag)\n\t\t}\n\t\t// A registered extension backend passes IsSupportedBackend so its\n\t\t// existing workspaces can be opened, but init provisions Dolt only and\n\t\t// would otherwise create the workspace and persist backend: dolt. Reject\n\t\t// it here rather than silently creating the wrong workspace; downstream","sourceCodeStart":511,"sourceCodeEnd":547,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/cmd/bd/init.go#L511-L547","documentation":"bd init wraps any failure from cfg.Validate() on the external proxied-server TLS/connection config built from --proxied-server-external-* flags. The %v is the underlying validation error (e.g. missing cert, bad server name, non-positive keep-alive). It signals the flag combination did not form a valid external endpoint config before any workspace side effects occur.","triggerScenarios":"Running `bd init` with --proxied-server-external-* flags (cert path, key path, server name, skip-verify, keep-alive) whose assembled proxied.Config fails Validate(), e.g. TLSKey set without TLSCert or invalid keep-alive duration.","commonSituations":"Typo'd or half-specified TLS flag pairs (cert without key), pointing cert/key paths at nonexistent files, invalid keep-alive values, copy-pasted server-internal flags mixed with external ones.","solutions":["Read the wrapped %v message to see exactly which field failed validation","Supply both external TLS cert and key paths together, or neither","Verify cert/key files exist and are readable at the given paths","Check that keep-alive / skip-verify flag values are well-formed","If you don't need an external proxied endpoint, drop the --proxied-server-external-* flags entirely"],"exampleFix":"// before\nbd init --proxied-server-external-tls-key ./key.pem\n// after\nbd init --proxied-server-external-tls-cert ./cert.pem --proxied-server-external-tls-key ./key.pem","handlingStrategy":"validation","validationCode":"if tlsCert != \"\" && tlsKey == \"\" {\n    return fmt.Errorf(\"--proxied-server-external-tls-key required when cert is set\")\n}\nif _, err := os.Stat(externalTLSKeyPath); err != nil {\n    return fmt.Errorf(\"external TLS key not readable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.Validate(); err != nil {\n    return fmt.Errorf(\"invalid --proxied-server-external-* config: %w\", err)\n}","preventionTips":["Always set external TLS cert and key flags as a pair","Stat the cert/key files before invoking bd init","Avoid mixing --proxied-server-* (internal) flags with external ones in scripts"],"tags":["cli","config-validation","tls","init"],"backgroundTag":"config-validation-failed","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}