caddyserver/caddy · error

creating storage configuration: %v

Error message

creating storage configuration: %v

What it means

After loading the storage module for a storage trust pool, its CertMagicStorage() conversion failed, so the module could not produce a certmagic.Storage implementation to read certificates from. This means the module loaded but its storage backend initialization errored.

Source

Thrown at modules/caddytls/capools.go:414

func (StoragePool) CaddyModule() caddy.ModuleInfo {
	return caddy.ModuleInfo{
		ID: "tls.ca_pool.source.storage",
		New: func() caddy.Module {
			return new(StoragePool)
		},
	}
}

// Provision implements caddy.Provisioner.
func (ca *StoragePool) Provision(ctx caddy.Context) error {
	if ca.StorageRaw != nil {
		val, err := ctx.LoadModule(ca, "StorageRaw")
		if err != nil {
			return fmt.Errorf("loading storage module: %v", err)
		}
		cmStorage, err := val.(caddy.StorageConverter).CertMagicStorage()
		if err != nil {
			return fmt.Errorf("creating storage configuration: %v", err)
		}
		ca.storage = cmStorage
	}
	if ca.storage == nil {
		ca.storage = ctx.Storage()
	}
	if len(ca.PEMKeys) == 0 {
		return fmt.Errorf("no PEM keys specified")
	}
	caPool := x509.NewCertPool()
	var certs []*x509.Certificate
	for _, caID := range ca.PEMKeys {
		bs, err := ca.storage.Load(ctx, caID)
		if err != nil {
			return fmt.Errorf("error loading cert '%s' from storage: %s", caID, err)
		}
		// Parse PEM to extract certificates
		pemData := bs

View on GitHub (pinned to 50e54ee279)

Solutions

1. Fix the storage module's own settings (create the root directory, correct paths/addresses/credentials).
2. Verify connectivity and permissions of the storage backend from the Caddy host (e.g. `ls` the directory, ping the redis endpoint).
3. Check the wrapped error text — it comes from the storage module and names the exact backend failure.

Example fix

# before
trust_pool storage {
  storage file_system {
    root /var/lib/caddy-missing
  }
  trusted_ca_certs_pem files/*.pem
}

# after
trust_pool storage {
  storage file_system {
    root /var/lib/caddy/certs
  }
  trusted_ca_certs_pem files/*.pem
}

// pre-flight the storage backend where possible, e.g. file_system root
import "os"

func storageRootReady(root string) error {
	info, err := os.Stat(root)
	if err != nil {
		return fmt.Errorf("storage root %s: %w", root, err)
	}
	if !info.IsDir() {
		return fmt.Errorf("storage root %s is not a directory", root)
	}
	return nil
}

// the wrapped error names the backend cause; log and fail the deploy, don't retry blindly
if err := pool.Provision(ctx); err != nil {
	if strings.Contains(err.Error(), "creating storage configuration") {
		// inspect inner error: fix backend (dirs, credentials, reachability) then reload
	}
	return err
}

When it happens

Trigger: The configured storage module's CertMagicStorage() returns an error — e.g. a file_system storage with an unwritable/nonexistent root, or a remote storage (redis/s3/etc.) that cannot be reached or has invalid connection settings.

Common situations: Storage root directory missing or wrong permissions; connection string secrets missing or wrong; backend service down at config load time.

Related errors

• loading storage module: %v
• no PEM keys specified
• WebSocket connections aren't allowed.
• Disabling same-origin restrictions is not allowed.
• Buggy browser is sending null Origin header.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/e95b2662515a78b7. Report an issue: GitHub.