{"record":{"id":"a5815a048e788a37","repo":"aaif-goose/goose","slug":"tls-was-requested-but-no-tls-backend-is-enabled-e","errorCode":null,"errorMessage":"TLS was requested but no TLS backend is enabled. Enable the `rustls-tls` or `native-tls` feature.","messagePattern":"TLS was requested but no TLS backend is enabled\\. Enable the `rustls-tls` or `native-tls` feature\\.","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/goose-cli/src/cli.rs","lineNumber":1519,"sourceCode":"            )\n            .await?;\n            info!(\"Starting ACP server on https://{}\", addr);\n\n            #[cfg(feature = \"rustls-tls\")]\n            axum_server::bind_rustls(addr, tls_setup.config)\n                .serve(router.into_make_service_with_connect_info::<SocketAddr>())\n                .await?;\n\n            #[cfg(feature = \"native-tls\")]\n            axum_server::bind_openssl(addr, tls_setup.config)\n                .serve(router.into_make_service_with_connect_info::<SocketAddr>())\n                .await?;\n        }\n\n        #[cfg(not(any(feature = \"rustls-tls\", feature = \"native-tls\")))]\n        {\n            let _ = (tls_cert_path, tls_key_path);\n            anyhow::bail!(\n                \"TLS was requested but no TLS backend is enabled. \\\n                 Enable the `rustls-tls` or `native-tls` feature.\"\n            );\n        }\n    } else {\n        info!(\"Starting ACP server on http://{}\", addr);\n        let listener = tokio::net::TcpListener::bind(addr).await?;\n        axum::serve(\n            listener,\n            router.into_make_service_with_connect_info::<SocketAddr>(),\n        )\n        .await?;\n    }\n\n    Ok(())\n}\n\nasync fn handle_session_subcommand(command: SessionCommand) -> Result<()> {","sourceCodeStart":1501,"sourceCodeEnd":1537,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/crates/goose-cli/src/cli.rs#L1501-L1537","documentation":"The ACP serve command can expose its axum router over HTTPS, but TLS backends are optional cargo features. When TLS cert/key paths are supplied and the binary was compiled without either the rustls-tls or native-tls feature, the cfg(not(any(...))) block unconditionally bails with this message before any listener is bound.","triggerScenarios":"Running the ACP server with tls_cert_path/tls_key_path set on a build produced by plain `cargo build` (no `--features rustls-tls` / `--features native-tls`), so only the plain tokio/axum HTTP branch is compiled in.","commonSituations":"Prebuilt or community binaries shipped without TLS features; building from source with default features; deployment docs that assume HTTPS support the installed binary does not have.","solutions":["Rebuild goose with a TLS backend: `cargo build --release --features rustls-tls` (or `native-tls`)","Run without TLS by omitting the cert/key flags so the plain HTTP listener path is taken","Terminate TLS in front of goose with a reverse proxy (nginx/caddy) and keep goose on http","If using a distributed binary, switch to a package/build that enables TLS features"],"exampleFix":"# before\ncargo build --release\ngoose acp --serve --tls-cert cert.pem --tls-key key.pem   # bails: no TLS backend\n\n# after\ncargo build --release --features rustls-tls\ngoose acp --serve --tls-cert cert.pem --tls-key key.pem","handlingStrategy":"validation","validationCode":"# Verify a TLS feature is compiled in before passing TLS flags\ncargo tree -e features -p goose-cli 2>/dev/null | grep -E 'rustls-tls|native-tls' \\\n  || echo 'no TLS feature enabled: rebuild with --features rustls-tls, or omit --tls-cert/--tls-key'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Document required cargo features in deployment runbooks","Prefer reverse-proxy TLS so the binary's feature set can stay minimal","Probe TLS support in deploy scripts before pointing health checks at https"],"tags":["tls","build-features","cli","network","configuration"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}