{"record":{"id":"bcf3f322de34caa4","repo":"sigoden/dufs","slug":"no-tls-key-set","errorCode":null,"errorMessage":"No tls-key set","messagePattern":"No tls-key set","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/args.rs","lineNumber":445,"sourceCode":"        }\n\n        if let Some(compress) = matches.get_one::<Compress>(\"compress\") {\n            args.compress = *compress;\n        }\n\n        #[cfg(feature = \"tls\")]\n        {\n            if let Some(tls_cert) = matches.get_one::<PathBuf>(\"tls-cert\") {\n                args.tls_cert = Some(tls_cert.clone())\n            }\n\n            if let Some(tls_key) = matches.get_one::<PathBuf>(\"tls-key\") {\n                args.tls_key = Some(tls_key.clone())\n            }\n\n            match (&args.tls_cert, &args.tls_key) {\n                (Some(_), Some(_)) => {}\n                (Some(_), _) => bail!(\"No tls-key set\"),\n                (_, Some(_)) => bail!(\"No tls-cert set\"),\n                (None, None) => {}\n            }\n        }\n        #[cfg(not(feature = \"tls\"))]\n        {\n            args.tls_cert = None;\n            args.tls_key = None;\n        }\n\n        Ok(args)\n    }\n\n    fn sanitize_path<P: AsRef<Path>>(path: P) -> Result<PathBuf> {\n        let path = path.as_ref();\n        if !path.exists() {\n            bail!(\"Path `{}` doesn't exist\", path.display());\n        }","sourceCodeStart":427,"sourceCodeEnd":463,"githubUrl":"https://github.com/sigoden/dufs/blob/fe7fd564f80dfbac361c8e0589c3845638149d38/src/args.rs#L427-L463","documentation":"dufs's CLI parser (Args::parse in src/args.rs) validates TLS options when the 'tls' feature is compiled in. If you pass --tls-cert but no matching --tls-key, it bails with 'No tls-key set' because a certificate alone cannot terminate TLS — both halves of the keypair are required.","triggerScenarios":"Running dufs with --tls-cert <path> but omitting --tls-key <path>. The match on (tls_cert, tls_key) hits the (Some(_), _) arm and bails before the server starts.","commonSituations":"Copy-pasted a TLS example and dropped the key flag; assumed the key is inferred from the cert file; scripted startup where only the cert path was templated in.","solutions":["Add --tls-key pointing to the PEM private key file","Use --tls-cert with both --tls-cert and --tls-key as a pair","If you don't need HTTPS, remove --tls-cert entirely instead"],"exampleFix":"# before\ndufs ./assets --tls-cert cert.pem\n# after\ndufs ./assets --tls-cert cert.pem --tls-key key.pem","handlingStrategy":"validation","validationCode":"# shell pre-check\nif [ -n \"$TLS_CERT\" ] && [ -z \"$TLS_KEY\" ]; then echo \"--tls-key is required with --tls-cert\"; exit 1; fi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass --tls-cert and --tls-key as a pair","Template both paths together in deployment scripts","Wrap the pair in a start script that checks both vars","Drop both flags when HTTPS is not needed"],"tags":["cli","tls","rust","configuration","missing-argument"],"backgroundTag":"missing-required-flag","analyzedSha":"fe7fd564f80dfbac361c8e0589c3845638149d38","analyzedAt":"2026-09-09T13:01:22.843Z","contentChangedAt":"2026-09-09T13:01:22.843Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}