{"record":{"id":"f62ca4b57cd573c3","repo":"ruvnet/RuView","slug":"homecore-tokens-is-required-use-insecure-dev-au","errorCode":null,"errorMessage":"HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development","messagePattern":"HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"v2/crates/homecore-server/src/main.rs","lineNumber":190,"sourceCode":"\n    /// Durable controller pairing database.\n    #[arg(\n        long,\n        env = \"HOMECORE_HAP_PAIRING_STORE\",\n        default_value = \".homecore/hap/pairings.json\"\n    )]\n    hap_pairing_store: std::path::PathBuf,\n}\n\n#[tokio::main]\nasync fn main() -> Result<()> {\n    init_tracing();\n    let mut cli = Cli::parse();\n    let has_tokens = std::env::var(\"HOMECORE_TOKENS\")\n        .map(|value| !value.trim().is_empty())\n        .unwrap_or(false);\n    if !has_tokens && !cli.insecure_dev_auth {\n        anyhow::bail!(\n            \"HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development\"\n        );\n    }\n    let tokens = if has_tokens {\n        let store = LongLivedTokenStore::from_env();\n        info!(\n            \"Provisioned {} bearer token(s) from HOMECORE_TOKENS\",\n            store.len().await\n        );\n        store\n    } else {\n        warn!(\n            \"Insecure development authentication enabled: any non-empty bearer token is accepted\"\n        );\n        LongLivedTokenStore::allow_any_non_empty()\n    };\n\n    info!(","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/v2/crates/homecore-server/src/main.rs#L172-L208","documentation":"Fail-fast bail in main(): the server refuses to start when the HOMECORE_TOKENS environment variable is unset or empty (checked via trim) and --insecure-dev-auth was not passed. This is a deliberate authentication guard -- either provision real long-lived bearer tokens (loaded by LongLivedTokenStore::from_env) or explicitly acknowledge an isolated dev setup with --insecure-dev-auth.","triggerScenarios":"Starting the server with HOMECORE_TOKENS unset; setting it to an empty string or whitespace only (trims to empty and counts as missing); deployment env files not loaded (systemd EnvironmentFile missing, .env not sourced); CI/containers launched without the variable.","commonSituations":"New deployments that have not minted tokens yet; systemd units where EnvironmentFile= points to a missing file; quoting mistakes leaving the variable empty (HOMECORE_TOKENS=''); scripts copied between environments dropping the export.","solutions":["Set HOMECORE_TOKENS to one or more non-empty bearer token values before starting the server","Check how the variable reaches the process: systemd EnvironmentFile, docker -e / compose environment, or shell export -- verify with 'tr : \"\\n\" < /proc/$PID/environ | grep HOMECORE' style checks that it is non-empty","For isolated local development only, start with --insecure-dev-auth (never in production or on shared networks)","Mint the tokens per the project's token-provisioning docs so clients authenticate with them as Bearer credentials"],"exampleFix":"# before\nsystemctl start homecore-server\n# Error: HOMECORE_TOKENS is required; use --insecure-dev-auth only for isolated development\n\n# after (unit file)\n[Service]\nEnvironmentFile=/etc/homecore/tokens.env   # HOMECORE_TOKENS=<non-empty token(s)>\nExecStart=/usr/local/bin/homecore-server","handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\nif [[ -z \"${HOMECORE_TOKENS// /}\" ]]; then\n  echo 'HOMECORE_TOKENS is empty or unset; refusing to start (dev only: add --insecure-dev-auth)' >&2\n  exit 1\nfi\nexec homecore-server \"$@\"","typeGuard":"fn auth_configured(tokens_env: Option<String>, insecure_dev_auth: bool) -> bool {\n    insecure_dev_auth || tokens_env.is_some_and(|v| !v.trim().is_empty())\n}","tryCatchPattern":null,"preventionTips":["Put HOMECORE_TOKENS in a dedicated EnvironmentFile mounted by systemd, and alert when it is missing","Reference tokens by name in configs; never bake them into unit files or logs","Reserve --insecure-dev-auth for loopback/isolated dev VMs and alert if it appears in prod flags"],"tags":["rust","authentication","environment","configuration","security","startup"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}