{"record":{"id":"a4a26e96a32d8581","repo":"jdx/mise","slug":"firewall-backend-requires-command","errorCode":null,"errorMessage":"firewall backend '{}' requires command '{}'","messagePattern":"firewall backend '(.+?)' requires command '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall.rs","lineNumber":983,"sourceCode":"        }\n    }\n    for backend in [\n        FirewallBackend::Nftables,\n        FirewallBackend::Firewalld,\n        FirewallBackend::Ufw,\n    ] {\n        if backend_available(backend) {\n            return Ok(backend);\n        }\n    }\n    bail!(\"no supported firewall backend found (tried nft, firewall-cmd, and ufw)\")\n}\n\nfn ensure_backend_available(backend: FirewallBackend) -> Result<()> {\n    if backend_available(backend) {\n        Ok(())\n    } else {\n        bail!(\n            \"firewall backend '{}' requires command '{}'\",\n            backend.label(),\n            backend.program().unwrap_or_default()\n        )\n    }\n}\n\nfn backend_available(backend: FirewallBackend) -> bool {\n    backend.program().and_then(crate::file::which).is_some()\n}\n\nfn backend_active(backend: FirewallBackend) -> bool {\n    match backend {\n        FirewallBackend::Nftables => command_output(\"nft\", &[\"list\", \"table\", \"inet\", NFT_TABLE])\n            .is_ok_and(|output| output.status.success()),\n        FirewallBackend::Firewalld => {\n            command_output(\"firewall-cmd\", &[\"--state\"]).is_ok_and(|output| output.status.success())\n        }","sourceCodeStart":965,"sourceCodeEnd":1001,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/firewall.rs#L965-L1001","documentation":"The config pins a specific firewall backend via `backend = \"nftables\" | \"firewalld\" | \"ufw\"`, but `ensure_backend_available` found that backend's CLI program is not on PATH, so mise refuses rather than silently switching backends. The message names both the selected backend label and the exact missing command. Install it, or drop/changed the `backend` key to let auto-detection pick what exists.","triggerScenarios":"`backend = \"ufw\"` on a firewalld-only RHEL box; `backend = \"nftables\"` where nft is not installed; or the command exists but is unreachable through the invoking PATH (sudo secure_path excluding /usr/sbin). Checked before any inspection or apply work.","commonSituations":"Sharing one mise.toml across heterogeneous hosts where only some have the pinned backend; minimal images; scripts that run mise under a reduced PATH; migrating configs from ufw machines to nftables-only servers.","solutions":["Install the named command: `apt install ufw`, `dnf install nftables`, `apt install nftables`, etc.","Or drop `backend` from `[bootstrap.linux.firewall]` so auto-detection (nft, then firewall-cmd, then ufw) picks an installed one.","Or change `backend` to the tool this host actually ships.","Ensure the program is on PATH for the invoking context: `sudo env PATH=\"$PATH:/usr/sbin:/sbin\" mise ...`."],"exampleFix":"# before (mise.toml)\n[bootstrap.linux.firewall]\nbackend = \"ufw\"        # ufw not installed on this host\n\n# after — let mise pick what exists\n[bootstrap.linux.firewall]\n# backend omitted; auto-detects nft -> firewall-cmd -> ufw\n# or pin what is installed: backend = \"nftables\"","handlingStrategy":"fallback","validationCode":"# pre-flight: the pinned backend's program must be on PATH\ncase \"$BACKEND\" in\n  nftables) command -v nft >/dev/null || echo 'install nftables' ;;\n  firewalld) command -v firewall-cmd >/dev/null || echo 'install firewalld' ;;\n  ufw) command -v ufw >/dev/null || echo 'install ufw' ;;\nesac","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin `backend` only when the fleet is homogeneous; otherwise omit it for auto-detection.","Verify with `mise bootstrap firewall status` after pinning.","Install the backend package before the first bootstrap run."],"tags":["mise","firewall","backend","missing-dependency","path","bootstrap","config"],"backgroundTag":"missing-system-dependency","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}