{"record":{"id":"ead0b8b6a24fcdb1","repo":"phacility/phabricator","slug":"failed-to-generate-an-intracluster-proxy-uri-even","errorCode":null,"errorMessage":"Failed to generate an intracluster proxy URI even though this request was routed as a proxy request.","messagePattern":"Failed to generate an intracluster proxy URI even though this request was routed as a proxy request\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSSHWorkflow.php","lineNumber":93,"sourceCode":"\n  final protected function getAlmanacServiceRefs($for_write) {\n    $viewer = $this->getSSHUser();\n    $repository = $this->getRepository();\n\n    $is_cluster_request = $this->getIsClusterRequest();\n\n    $refs = $repository->getAlmanacServiceRefs(\n      $viewer,\n      array(\n        'neverProxy' => $is_cluster_request,\n        'protocols' => array(\n          'ssh',\n        ),\n        'writable' => $for_write,\n      ));\n\n    if (!$refs) {\n      throw new Exception(\n        pht(\n          'Failed to generate an intracluster proxy URI even though this '.\n          'request was routed as a proxy request.'));\n    }\n\n    return $refs;\n  }\n\n  final protected function getProxyCommand($for_write) {\n    $refs = $this->getAlmanacServiceRefs($for_write);\n\n    $ref = head($refs);\n\n    return $this->getProxyCommandForServiceRef($ref);\n  }\n\n  final protected function getProxyCommandForServiceRef(\n    DiffusionServiceRef $ref) {","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php#L75-L111","documentation":"For repositories bound to an Almanac cluster service, an SSH request that is itself already a cluster request must be served locally (neverProxy). getAlmanacServiceRefs then asks the repository for service refs filtered to the ssh protocol, the required writability, and no-proxy mode; an empty result means this host cannot legally serve the repository and no proxy target exists either, so it throws.","triggerScenarios":"A device-authenticated or proxied SSH operation against a clusterized repository where no matching SSH service binding is visible: the device is not bound to the service, the service lacks ssh interfaces, or a write arrives with no writable nodes bound.","commonSituations":"Half-finished cluster setups (repo bound to a service, devices registered, bindings or interfaces incomplete); Almanac network mismatches; read-only services receiving pushes.","solutions":["Open the repository's Almanac service and verify every cluster device is bound with an ssh interface","Confirm the repository's URI list actually binds the cluster service you expect (Manage -> URIs)","For writes, ensure at least one bound device is writable","Run bin/almanac register on each device and re-test the operation"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  $refs = $workflow->getAlmanacServiceRefs($for_write);\n} catch (Exception $ex) {\n  // Cluster topology cannot serve this request: surface an operational\n  // alert pointing at the repository's Almanac bindings and device registration.\n  throw new PhabricatorApplicationTransactionValidationErrorException(\n    null, pht('Cluster'), $ex->getMessage());\n}","preventionTips":["Finish Almanac service bindings (device + ssh interface) before binding repositories to the service","Verify writable nodes exist for repositories that receive pushes","Re-run bin/almanac register after adding or reimaging cluster nodes"],"tags":["cluster","almanac","ssh","diffusion"],"backgroundTag":"cluster-service-misconfigured","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}