{"record":{"id":"e7f9e49a7445eaec","repo":"Dokploy/dokploy","slug":"precondition-failed","errorCode":"PRECONDITION_FAILED","errorMessage":"Set the authentication domain for this server before deploying the proxy.","messagePattern":"Set the authentication domain for this server before deploying the proxy\\.","errorType":"exception","errorClass":"TRPCError","httpStatus":412,"severity":"error","filePath":"packages/server/src/services/proprietary/forward-auth.ts","lineNumber":191,"sourceCode":"\treturn { callbackUrl: forwardAuthCallbackUrl(input.authDomain, input.https) };\n};\n\nexport const removeForwardAuthSettings = async (serverId: string | null) => {\n\tconst existing = await getForwardAuthSettings(serverId);\n\tif (!existing) return { ok: true } as const;\n\tawait removeForwardAuthDomain(serverId);\n\tawait db.delete(forwardAuthSettings).where(settingsWhere(serverId));\n\treturn { ok: true } as const;\n};\n\nexport const deployForwardAuthOnServer = async (input: {\n\tserverId?: string;\n\tproviderId: string;\n\torganizationId: string;\n}) => {\n\tconst settings = await getForwardAuthSettings(input.serverId ?? null);\n\tif (!settings) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"PRECONDITION_FAILED\",\n\t\t\tmessage:\n\t\t\t\t\"Set the authentication domain for this server before deploying the proxy.\",\n\t\t});\n\t}\n\n\tconst provider = await findProviderForOrg(\n\t\tinput.providerId,\n\t\tinput.organizationId,\n\t);\n\tconst oidc = resolveOidcConfig(provider);\n\n\tawait setupForwardAuth({\n\t\tserverId: input.serverId,\n\t\toidc,\n\t\tcookieSecret: deriveCookieSecret(\n\t\t\t`${input.serverId ?? \"host\"}:${settings.baseDomain}`,\n\t\t),","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/services/proprietary/forward-auth.ts#L173-L209","documentation":"deployForwardAuthOnServer first reads forward-auth settings for the server (via getForwardAuthSettings). If no settings exist — the authentication domain for the server was never configured — it throws PRECONDITION_FAILED telling the admin to set the authentication domain before deploying the proxy. Deployment is a two-step process: configure settings, then deploy.","triggerScenarios":"Calling setForwardAuthSettings/deploy flows before any forward-auth settings row exists for the target server — i.e. the authentication domain (e.g. auth.example.com) was never saved for this server.","commonSituations":"Fresh server setup where the admin jumps straight to deploying the proxy without first setting the auth domain; serverId omitted so settings are looked up for the null/default server while settings were saved for a specific server; settings saved for a different server instance.","solutions":["First call the forward-auth settings endpoint to set the authentication domain for this server, then retry deployment","Pass the correct serverId so settings resolve to the intended server","If settings were saved under another server, re-save them for the current one"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const settings = await getForwardAuthSettings(serverId);\nif (!settings) { /* route admin to SSO settings first */ }","typeGuard":null,"tryCatchPattern":"try { await deployForwardAuthOnServer(input) } catch (e) { if (e instanceof TRPCError && e.code === 'PRECONDITION_FAILED') { /* open settings wizard */ } }","preventionTips":["Enforce settings-before-deploy ordering in the UI","Disable the deploy button until the auth domain is set"],"tags":["forward-auth","sso","preconditions","server-setup"],"backgroundTag":"precondition-missing-configuration","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}