caddyserver/caddy · error

include and exclude must not intersect, but found %s in both

Error message

include and exclude must not intersect, but found %s in both lists

What it means

CustomLog validation rejects a logs entry where the same namespace appears in both include and exclude. Caddy treats these lists as rules plus exceptions; an identical entry in both is a direct contradiction, so it fails fast during config validation.

Source

Thrown at logging.go:506

}

func (cl *CustomLog) provision(ctx Context, logging *Logging) error {
	if err := cl.provisionCommon(ctx, logging); err != nil {
		return err
	}

	// If both Include and Exclude lists are populated, then each item must
	// be a superspace or subspace of an item in the other list, because
	// populating both lists means that any given item is either a rule
	// or an exception to another rule. But if the item is not a super-
	// or sub-space of any item in the other list, it is neither a rule
	// nor an exception, and is a contradiction. Ensure, too, that the
	// sets do not intersect, which is also a contradiction.
	if len(cl.Include) > 0 && len(cl.Exclude) > 0 {
		// prevent intersections
		for _, allow := range cl.Include {
			if slices.Contains(cl.Exclude, allow) {
				return fmt.Errorf("include and exclude must not intersect, but found %s in both lists", allow)
			}
		}

		// ensure namespaces are nested
	outer:
		for _, allow := range cl.Include {
			for _, deny := range cl.Exclude {
				if strings.HasPrefix(allow+".", deny+".") ||
					strings.HasPrefix(deny+".", allow+".") {
					continue outer
				}
			}
			return fmt.Errorf("when both include and exclude are populated, each element must be a superspace or subspace of one in the other list; check '%s' in include", allow)
		}
	}
	return nil
}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Find the duplicated namespace named in the error message and remove it from one of the two lists.
2. Decide whether the logger should emit to this sink (keep in include, drop from exclude) or not (the reverse).
3. Re-run caddy validate / reload and confirm the error is gone.

Example fix

// before (caddyfile)
log my-log {
    include http.handlers.reverse_proxy
    exclude http.handlers.reverse_proxy
    output file /var/log/caddy/rp.log
}

// after
log my-log {
    include http.handlers.reverse_proxy
    output file /var/log/caddy/rp.log
}

// before submitting config: reject intersecting include/exclude
func noIntersection(include, exclude []string) error {
    for _, inc := range include {
        if slices.Contains(exclude, inc) {
            return fmt.Errorf("%s appears in both include and exclude", inc)
        }
    }
    return nil
}

if err := caddy.Validate(cfg); err != nil {
    if strings.Contains(err.Error(), "must not intersect") {
        // remove the named namespace from one list and re-validate
    }
    return err
}

When it happens

Trigger: A logs block with both include and exclude arrays that share at least one identical string, e.g. include ["http.handlers.reverse_proxy"] and exclude ["http.handlers.reverse_proxy"].

Common situations: Growing exclude lists incrementally until one duplicates an include entry; generated configs that concatenate lists from different sources; refactors that move a namespace from include to exclude without deleting the original.

Related errors

• invalid action type
• unrecognized log level: %s
• no identifiers configured
• loading log encoder module: %v
• when both include and exclude are populated, each element mu

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/bca213a787a521b3. Report an issue: GitHub.