{"record":{"id":"cdac7839f436483b","repo":"caddyserver/caddy","slug":"provisioning-default-public-automation-policy-v","errorCode":null,"errorMessage":"provisioning default public automation policy: %v","messagePattern":"provisioning default public automation policy: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":296,"sourceCode":"\tif t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.PermissionRaw != nil {\n\t\tif t.Automation.OnDemand.Ask != \"\" {\n\t\t\treturn fmt.Errorf(\"on-demand TLS config conflict: both 'ask' endpoint and a 'permission' module are specified; 'ask' is deprecated, so use only the permission module\")\n\t\t}\n\t\tval, err := ctx.LoadModule(t.Automation.OnDemand, \"PermissionRaw\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading on-demand TLS permission module: %v\", err)\n\t\t}\n\t\tt.Automation.OnDemand.permission = val.(OnDemandPermission)\n\t}\n\n\t// automation/management policies\n\tif t.Automation == nil {\n\t\tt.Automation = new(AutomationConfig)\n\t}\n\tt.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy)\n\terr = t.Automation.defaultPublicAutomationPolicy.Provision(t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"provisioning default public automation policy: %v\", err)\n\t}\n\tfor n := range t.automateNames {\n\t\t// if any names specified by the \"automate\" loader do not qualify for a public\n\t\t// certificate, we should initialize a default internal automation policy\n\t\t// (but we don't want to do this unnecessarily, since it may prompt for password!)\n\t\tif certmagic.SubjectQualifiesForPublicCert(n) {\n\t\t\tcontinue\n\t\t}\n\t\tt.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{\n\t\t\tIssuersRaw: []json.RawMessage{json.RawMessage(`{\"module\":\"internal\"}`)},\n\t\t}\n\t\terr = t.Automation.defaultInternalAutomationPolicy.Provision(t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning default internal automation policy: %v\", err)\n\t\t}\n\t\tbreak\n\t}\n\tfor i, ap := range t.Automation.Policies {","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L278-L314","documentation":"Caddy always creates an implicit default public automation policy (used for any names not matched by explicit policies) and provisions it via AutomationPolicy.Provision. This error means that implicit policy failed — most commonly the default issuers (ACME/ZeroSSL) could not be provisioned, e.g. missing ACME account email, or a default storage/issuer construction error inside automation.go.","triggerScenarios":"DefaultIssuersProvisioned failing — e.g. explicitly disabled ACME issuer combined with an email requirement, or errors building certmagic config for defaults; also fails if global storage is misconfigured since the default policy inherits app storage. Because the policy is synthesized (empty AutomationPolicy), user-triggerable causes are indirect: global tls settings like 'acme_ca', 'email', or storage modules.","commonSituations":"Custom global issuer settings (e.g. acme_ca pointing to a bad URL shape), storage plugin failures, or experimental Caddy builds where default issuer wiring changed; frequently the wrapped error pinpoints the real cause in automation.go.","solutions":["Read the wrapped error text — it originates in AutomationPolicy.Provision and names the sub-step (issuers, storage, certmagic config)","Simplify: remove global tls customizations (acme_ca, email, storage) and re-add one at a time to isolate","Ensure any storage plugin configured at the app level loads correctly","Check that you are not disabling both default issuers without providing replacements in automation.policies"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep global tls settings minimal and test each addition (acme_ca, email, storage) with 'caddy validate'","The wrapped error is always the real diagnosis — read it before changing config"],"tags":["caddy","tls","automation-policy","provisioning","acme"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}