{"record":{"id":"e8fc0424d6b1a224","repo":"AdguardTeam/AdGuardHome","slug":"initializing-auth-module-w","errorCode":null,"errorMessage":"initializing auth module: %w","messagePattern":"initializing auth module: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/home/home.go","lineNumber":1123,"sourceCode":"\t\tbaseLogger.WarnContext(ctx, \"authratelimiter is disabled\")\n\t\trateLimiter = emptyRateLimiter{}\n\t}\n\n\tdataDirPath := filepath.Join(workDir, dataDir)\n\tauth, err = newAuth(ctx, &authConfig{\n\t\tbaseLogger:      baseLogger,\n\t\tmux:             mux,\n\t\trateLimiter:     rateLimiter,\n\t\ttrustedProxies:  netutil.SliceSubnetSet(netutil.UnembedPrefixes(config.DNS.TrustedProxies)),\n\t\tdbFilename:      filepath.Join(dataDirPath, sessionsDBName),\n\t\tdoHRoutes:       config.HTTPConfig.DoH.Routes,\n\t\tusers:           config.Users,\n\t\tsessionTTL:      time.Duration(config.HTTPConfig.SessionTTL),\n\t\tisGLiNet:        isGLiNet,\n\t\tgliNetTokenRoot: glTokenRoot,\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"initializing auth module: %w\", err)\n\t}\n\n\tconfig.Users = nil\n\n\treturn auth, nil\n}\n\nfunc (c *configuration) anonymizer() (ipmut *aghnet.IPMut) {\n\tvar anonFunc aghnet.IPMutFunc\n\tif c.DNS.AnonymizeClientIP {\n\t\tanonFunc = querylog.AnonymizeIP\n\t}\n\n\treturn aghnet.NewIPMut(anonFunc)\n}\n\n// permCheckHelp is printed when binding to privileged ports is not permitted.\nconst permCheckHelp = `Permission check failed.","sourceCodeStart":1105,"sourceCodeEnd":1141,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/home.go#L1105-L1141","documentation":"AdGuard Home could not initialize its authentication/user module (aghnet/home auth init). The users module validates the configured user list (name/password hashes) and fails when the configuration is invalid.","triggerScenarios":"Calling initUsers during run when config.Users contains malformed entries — e.g. invalid bcrypt password hash strings, empty username, or unsupported hash format after a config migration.","commonSituations":"Hand-edited YAML config with broken password hashes, config migrated from a very old version, or a corrupted yaml.yaml after disk issues.","solutions":["Inspect the wrapped error and the users: section of yaml.yaml for malformed password hashes","Fix or remove the offending user entries; a fresh hash can be generated with bcrypt","As a last resort, remove the users list to recreate the first user through the install wizard"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate user password hashes before passing config.Users:\nfor _, u := range cfg.Users {\n    if u.Name == \"\" { return errors.New(\"empty username\") }\n    if _, err := bcrypt.Cost([]byte(u.PasswordHash)); err != nil {\n        return fmt.Errorf(\"user %s: bad hash: %w\", u.Name, err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit password hashes in yaml.yaml; use the UI/API","Back up yaml.yaml before upgrades"],"tags":["go","auth","config","users","bcrypt"],"backgroundTag":"auth-config-initialization-failed","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}