{"record":{"id":"cdc7eaae36191cb5","repo":"cloudflare/cloudflared","slug":"errnoingressrulescli","errorCode":"ErrNoIngressRulesCLI","errorMessage":"No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests","messagePattern":"No ingress rules were defined in provided config \\(if any\\) nor from the cli, cloudflared will return 503 for all incoming HTTP requests","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"ingress/ingress.go","lineNumber":23,"sourceCode":"\t\"net\"\n\t\"net/url\"\n\t\"regexp\"\n\t\"strconv\"\n\t\"strings\"\n\n\t\"github.com/pkg/errors\"\n\t\"github.com/rs/zerolog\"\n\t\"github.com/urfave/cli/v2\"\n\t\"golang.org/x/net/idna\"\n\n\t\"github.com/cloudflare/cloudflared/config\"\n\t\"github.com/cloudflare/cloudflared/ingress/middleware\"\n\t\"github.com/cloudflare/cloudflared/ipaccess\"\n)\n\nvar (\n\tErrNoIngressRules             = errors.New(\"The config file doesn't contain any ingress rules\")\n\tErrNoIngressRulesCLI          = errors.New(\"No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests\")\n\terrLastRuleNotCatchAll        = errors.New(\"The last ingress rule must match all URLs (i.e. it should not have a hostname or path filter)\")\n\terrBadWildcard                = errors.New(\"Hostname patterns can have at most one wildcard character (\\\"*\\\") and it can only be used for subdomains, e.g. \\\"*.example.com\\\"\")\n\terrHostnameContainsPort       = errors.New(\"Hostname cannot contain a port\")\n\tErrURLIncompatibleWithIngress = errors.New(\"You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules\")\n)\n\nconst (\n\tServiceBastion     = \"bastion\"\n\tServiceSocksProxy  = \"socks-proxy\"\n\tServiceWarpRouting = \"warp-routing\"\n)\n\n// FindMatchingRule returns the index of the Ingress Rule which matches the given\n// hostname and path. This function assumes the last rule matches everything,\n// which is the case if the rules were instantiated via the ingress#Validate method.\n//\n// Negative index rule signifies local cloudflared rules (not-user defined).\nfunc (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/ingress.go#L5-L41","documentation":"ErrNoIngressRulesCLI is returned by ParseIngressFromConfigAndCLI, parseSingleOriginService, and RoundTrip when neither the config file nor the CLI flags define any ingress rules. Unlike ErrNoIngressRules it is a soft condition: cloudflared falls back to a default origin and will return 503 for all incoming HTTP requests unless remote configuration supplies rules.","triggerScenarios":"Running cloudflared with no ingress block in the config file and no --url/single-origin CLI flag (ingress.go:112-116); starting a token-less tunnel where no local rules exist so the warning is logged via log.Warn().Msg(ErrNoIngressRulesCLI.Error()); RoundTrip encountering a config with zero rules from both sources.","commonSituations":"Launching cloudflared with only a token and no local ingress config; forgetting --url when no config file exists; config file present but with no ingress section and no CLI origin flags, causing every request to get 503.","solutions":["Define ingress rules in the config file, or pass --url to set a single origin","Pass a tunnel token so remote configuration can supply ingress rules","Treat this as a warning: confirm the fallback default origin (newDefaultOrigin) is acceptable","Run `cloudflared tunnel ingress validate` (or `cloudflared tunnel ingress rule ...`) to verify rules resolve before serving"],"exampleFix":"// before\ncloudflared tunnel run mytunnel  // no config ingress, no --url -> 503s\n// after\ncloudflared tunnel --url http://localhost:8080 run mytunnel\n// or add to config.yml:\n// ingress:\n//   - service: http://localhost:8080\n//   - service: http_status:404","handlingStrategy":"validation","validationCode":"if !cmd.IsSet(\"url\") && !cmd.IsSet(\"token\") && (cfg == nil || len(cfg.Ingress) == 0) {\n    log.Warn().Msg(\"no ingress rules and no origin: all requests will get 503 until remote config loads\")\n}","typeGuard":"func hasAnyIngressSource(cfg *config.Configuration, cmd IsSetFn) bool {\n    return (cfg != nil && len(cfg.Ingress) > 0) || cmd.IsSet(\"url\") || cmd.IsSet(\"token\")\n}","tryCatchPattern":"rules, err := ingress.ParseIngressFromConfigAndCLI(c, flags, log)\nif errors.Is(err, ingress.ErrNoIngressRulesCLI) {\n    log.Warn().Msg(\"falling back to default origin; requests will 503 until remote config arrives\")\n    rules = newDefaultOrigin(c, log)\n}","preventionTips":["Pass --url or provide a token when no local ingress is configured","Include an ingress block in the config file even for single-origin setups","Check startup warnings — 503s usually mean this fallback triggered"],"tags":["ingress","configuration","cli"],"backgroundTag":"missing-required-config","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}