{"record":{"id":"ca97b9b4c7015be0","repo":"AdguardTeam/AdGuardHome","slug":"validating-tcp-ports-w","errorCode":null,"errorMessage":"validating tcp ports: %w","messagePattern":"validating tcp ports: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/home/config.go","lineNumber":781,"sourceCode":"\n\tudpPorts := aghalg.UniqChecker[udpPort]{}\n\taddPorts(udpPorts, udpPort(config.DNS.Port))\n\n\tif config.TLS.Enabled {\n\t\taddPorts(\n\t\t\ttcpPorts,\n\t\t\ttcpPort(config.TLS.PortHTTPS),\n\t\t\ttcpPort(config.TLS.PortDNSOverTLS),\n\t\t\ttcpPort(config.TLS.PortDNSCrypt),\n\t\t)\n\n\t\t// TODO(e.burkov):  Consider adding a udpPort with the same value when\n\t\t// we add support for HTTP/3 for web admin interface.\n\t\taddPorts(udpPorts, udpPort(config.TLS.PortDNSOverQUIC))\n\t}\n\n\tif err = tcpPorts.Validate(); err != nil {\n\t\treturn fmt.Errorf(\"validating tcp ports: %w\", err)\n\t} else if err = udpPorts.Validate(); err != nil {\n\t\treturn fmt.Errorf(\"validating udp ports: %w\", err)\n\t}\n\n\tif !filtering.ValidateUpdateIvl(config.Filtering.FiltersUpdateIntervalHours) {\n\t\tconfig.Filtering.FiltersUpdateIntervalHours = 24\n\t}\n\n\tif len(config.Users) == 0 {\n\t\tl.WarnContext(ctx, \"no users in the configuration file; authentication is disabled\")\n\t}\n\n\tif config.Language != \"\" && !allowedLanguages.Has(config.Language) {\n\t\tl.WarnContext(ctx, \"unsupported language\", \"lang\", config.Language)\n\n\t\t// Clear the language so the frontend can use the client's browser\n\t\t// language.\n\t\tconfig.Language = \"\"","sourceCodeStart":763,"sourceCodeEnd":799,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/config.go#L763-L799","documentation":"The set of TCP ports used by the web interface, DNS-over-TLS, and DNS-over-HTTPS has an invalid combination (duplicate or out-of-range values) according to tcpPorts.Validate().","triggerScenarios":"Config where http_port, tls port_dns_over_tls, and/or port_dns_over_https collide or contain values outside 1-65535.","commonSituations":"Hand-edited YAML assigning the same port to HTTP and DoT/DoH, ports below 1024 without privileges intended, typos like 853853 or 0.","solutions":["Make http_port, port_dns_over_tls and port_dns_over_https distinct valid ports (e.g. 80/3000, 853, 443)","Re-run with the setup wizard or reset ports to defaults if unsure","Check the wrapped validation error for which port set failed"],"exampleFix":"# before\nhttp_port: 443\ntls:\n  port_dns_over_https: 443\n# after\nhttp_port: 3000\ntls:\n  port_dns_over_https: 443","handlingStrategy":"validation","validationCode":"// Ensure TCP ports are unique and in range before applying config\nports := []int{cfg.HTTPPort, cfg.TLS.PortDNSOverTLS, cfg.TLS.PortDNSOverHTTPS}\nseen := map[int]bool{}\nfor _, p := range ports {\n    if p < 1 || p > 65535 || seen[p] { return errors.New(\"bad tcp ports\") }\n    seen[p] = true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reserve distinct ports for HTTP, DoT, DoH, DoQ","Prefer setup wizard over hand-editing port values"],"tags":["config","ports","tls","validation","startup"],"backgroundTag":"port-conflict","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}