{"record":{"id":"b1764168776805a9","repo":"phacility/phabricator","slug":"this-service-is-configured-to-operate-in-cluster-m","errorCode":null,"errorMessage":"This service is configured to operate in cluster mode, but %s is not defined in the request context. Your webserver configuration needs to forward %s to PHP so the software can reject requests received on external interfaces.","messagePattern":"This service is configured to operate in cluster mode, but (.+?) is not defined in the request context\\. Your webserver configuration needs to forward (.+?) to PHP so the software can reject requests received on external interfaces\\.","errorType":"exception","errorClass":"AphrontMalformedRequestException","httpStatus":500,"severity":"warning","filePath":"src/aphront/configuration/AphrontApplicationConfiguration.php","lineNumber":419,"sourceCode":"    // also have a public address like \"51.23.95.16\". Assuming the cluster\n    // is configured on a range like \"170.0.0.0/16\", we want to reject the\n    // requests received on the public interface.\n    //\n    // Ideally, nodes in a cluster should only be listening on internal\n    // interfaces, but they may be configured in such a way that they also\n    // listen on external interfaces, since this is easy to forget about or\n    // get wrong. As a broad security measure, reject requests received on any\n    // interfaces which aren't on the whitelist.\n\n    $cluster_addresses = PhabricatorEnv::getEnvConfig('cluster.addresses');\n    if ($cluster_addresses) {\n      $server_addr = idx($_SERVER, 'SERVER_ADDR');\n      if (!$server_addr) {\n        if (php_sapi_name() == 'cli') {\n          // This is a command line script (probably something like a unit\n          // test) so it's fine that we don't have SERVER_ADDR defined.\n        } else {\n          throw new AphrontMalformedRequestException(\n            pht('No %s', 'SERVER_ADDR'),\n            pht(\n              'This service is configured to operate in cluster mode, but '.\n              '%s is not defined in the request context. Your webserver '.\n              'configuration needs to forward %s to PHP so the software can '.\n              'reject requests received on external interfaces.',\n              'SERVER_ADDR',\n              'SERVER_ADDR'));\n        }\n      } else {\n        if (!PhabricatorEnv::isClusterAddress($server_addr)) {\n          throw new AphrontMalformedRequestException(\n            pht('External Interface'),\n            pht(\n              'This service is configured in cluster mode and the address '.\n              'this request was received on (\"%s\") is not whitelisted as '.\n              'a cluster address.',\n              $server_addr));","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/aphront/configuration/AphrontApplicationConfiguration.php#L401-L437","documentation":"Thrown by 'bin/repository thaw' when the operator declines the 'DATA AT RISK' confirmation prompt. Because thaw discards working copy versions on demoted devices or other leaders on promote, the workflow prints a permanent-data-loss warning and asks 'Accept the possibility of permanent data loss?'; answering 'n' aborts cleanly via PhutilArgumentUsageException. No state was changed when this is thrown.","triggerScenarios":"Running 'bin/repository thaw --demote db-001 R12' without '--force' and answering 'n' (or sending EOF/no TTY in automation, where phutil_console_confirm fails as a declined prompt) at line 187.","commonSituations":"Interactive recovery sessions where the operator hesitates after seeing the DATA AT RISK banner; cron/CI jobs invoking thaw without '--force' so the prompt reads EOF from stdin and aborts; operators testing what thaw would do.","solutions":["Re-run the command and answer 'y' to the prompt once you have verified which device holds the authoritative copy.","For automation, add '--force' after reviewing the risk, e.g. 'bin/repository thaw --demote db-001 R12 --force'.","If unsure which device has the newest version, inspect PhabricatorRepositoryWorkingCopyVersion rows first and only then confirm."],"exampleFix":"# before (interactive, declined)\nbin/repository thaw --demote db-001 R12\n# -> Accept the possibility of permanent data loss? [y/N] n\n\n# after (verified, non-interactive)\nbin/repository thaw --demote db-001 R12 --force","handlingStrategy":"try-catch","validationCode":"# Automation: decide interactiveness explicitly\nif [ \"$CI\" = \"1\" ]; then FORCE=--force; fi\nbin/repository thaw --demote \"$DEVICE\" $REPOS $FORCE","typeGuard":null,"tryCatchPattern":"try {\n  // workflow invocation / exec of bin/repository thaw\n} catch (PhutilArgumentUsageException $ex) {\n  if (preg_match('/aborted/', $ex->getMessage())) { /* treat as clean cancel, exit 0 */ }\n  throw $ex;\n}","preventionTips":["Pass --force in non-interactive automation only after a dry review of which device holds the authoritative copy.","Give cron jobs no stdin so prompts fail loudly instead of half-reading input."],"tags":["phabricator","cli","confirmation-prompt","data-loss","cluster-repositories"],"backgroundTag":"confirmation-aborted","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}