{"record":{"id":"bc1b29f51b6e5b11","repo":"caddyserver/caddy","slug":"storing-stek-gob-v","errorCode":null,"errorMessage":"storing STEK gob: %v","messagePattern":"storing STEK gob: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"modules/caddytls/distributedstek/distributedstek.go","lineNumber":141,"sourceCode":"\t\treturn sg, err // don't wrap, in case error is certmagic.ErrNotExist\n\t}\n\tdec := gob.NewDecoder(bytes.NewReader(gobBytes))\n\terr = dec.Decode(&sg)\n\tif err != nil {\n\t\treturn sg, fmt.Errorf(\"STEK gob corrupted: %v\", err)\n\t}\n\treturn sg, nil\n}\n\nfunc (s *Provider) storeSTEK(dstek distributedSTEK) error {\n\tvar buf bytes.Buffer\n\terr := gob.NewEncoder(&buf).Encode(dstek)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"encoding STEK gob: %v\", err)\n\t}\n\terr = s.storage.Store(s.ctx, stekFileName, buf.Bytes())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"storing STEK gob: %v\", err)\n\t}\n\treturn nil\n}\n\n// getSTEK locks and loads the current STEK from storage. If none\n// currently exists, a new STEK is created and persisted. If the\n// current STEK is outdated (NextRotation time is in the past),\n// then it is rotated and persisted. The resulting STEK is returned.\nfunc (s *Provider) getSTEK() (distributedSTEK, error) {\n\terr := s.storage.Lock(s.ctx, stekLockName)\n\tif err != nil {\n\t\treturn distributedSTEK{}, fmt.Errorf(\"failed to acquire storage lock: %v\", err)\n\t}\n\n\t//nolint:errcheck\n\tdefer s.storage.Unlock(s.ctx, stekLockName)\n\n\t// load the current STEKs from storage","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/distributedstek/distributedstek.go#L123-L159","documentation":"storeSTEK writes the gob-encoded STEK bytes to the configured storage via Store(); write failures are wrapped as 'storing STEK gob'. This is an infrastructure-level failure: the storage backend rejected the write.","triggerScenarios":"File storage: disk full, permission denied on the storage dir, read-only filesystem. Plugin storage (Redis/S3/etc.): connection lost, credentials expired, quota exceeded. Also possible when the storage lock expires mid-write under contention.","commonSituations":"Containers with small ephemeral volumes filling up; Redis evictions or restarts; IAM credential rotation on object storage; NFS stale handles.","solutions":["Check the wrapped backend error — it names the real cause (ENOSPC, EACCES, connection refused, etc.)","Free space / fix permissions on the storage root (commonly /var/lib/caddy) for file storage","Restore connectivity or credentials for the storage plugin, then reload Caddy so STEK rotation retries","If using network storage under heavy multi-instance contention, verify the lock timeout settings of the storage plugin"],"exampleFix":"# before: storage volume full\nFilesystem      Size  Used Avail Use% Mounted on\n/dev/xvda1        8G   8G     0 100% /\n\n# after: free space, then reload\ndocker system prune -f   # or grow the volume\nsystemctl reload caddy","handlingStrategy":"retry","validationCode":"// Pre-deploy capacity check for file storage (the common backend)\n// (shell) df -h /var/lib/caddy && test -w /var/lib/caddy","typeGuard":null,"tryCatchPattern":"// Ops automation: on 'storing STEK gob' alerts, inspect the wrapped cause, repair the backend\n// (free space / restore Redis), then reload Caddy — the provider retries rotation on next cycle.\nif alert.Msg matches \"storing STEK gob\" {\n\trepairStorageBackend()\n\tsystemctl reload caddy\n}","preventionTips":["Alert on storage usage (>80% full) for the Caddy data volume","Run 'caddy validate' plus a storage write smoke test in deploy pipelines","Give the caddy user ownership of its storage root; avoid read-only mounts"],"tags":["tls","stek","storage","infrastructure"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}