caddyserver/caddy · error

provisioning 'ask' module: %v

Error message

provisioning 'ask' module: %v

What it means

After the ask URL is successfully replaced, Caddy constructs a PermissionByHTTP{Endpoint: ask} module and provisions it with the app context. If that Provision fails — principally endpoint URL parsing/validation — this error is returned. It is the provisioning of the legacy ask mechanism converted into the modern permission module.

Source

Thrown at modules/caddytls/tls.go:331

	}
	for i, ap := range t.Automation.Policies {
		err := ap.Provision(t)
		if err != nil {
			return fmt.Errorf("provisioning automation policy %d: %v", i, err)
		}
	}

	// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)
	if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
		t.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)
		if err != nil {
			return fmt.Errorf("preparing 'ask' endpoint: %v", err)
		}
		perm := PermissionByHTTP{
			Endpoint: t.Automation.OnDemand.Ask,
		}
		if err := perm.Provision(ctx); err != nil {
			return fmt.Errorf("provisioning 'ask' module: %v", err)
		}
		t.Automation.OnDemand.permission = perm
	}

	// session ticket ephemeral keys (STEK) service and provider
	if t.SessionTickets != nil {
		err := t.SessionTickets.provision(ctx)
		if err != nil {
			return fmt.Errorf("provisioning session tickets configuration: %v", err)
		}
	}

	// ECH (Encrypted ClientHello) initialization
	if t.EncryptedClientHello != nil {
		outerNames, err := t.EncryptedClientHello.Provision(ctx)
		if err != nil {
			return fmt.Errorf("provisioning Encrypted ClientHello components: %v", err)
		}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Make the ask value an absolute URL including scheme: http:// or https://host[:port]/path
2. Trim whitespace and verify with 'caddy validate'
3. Prefer migrating to the explicit permission module: {"permission": {"module": "http", "endpoint": "..."}}

Example fix

// before
"on_demand": {"ask": "localhost:5555/check"}
// after
"on_demand": {"ask": "http://localhost:5555/check"}

if _, err := url.ParseRequestURI(tlsApp.Automation.OnDemand.Ask); err != nil {
	return fmt.Errorf("ask must be a valid absolute URL: %w", err)
}

When it happens

Trigger: on_demand.ask set to a string that is not a parseable/valid URL for the permission module's validation (e.g. "localhost:5555/check" without scheme, or a URL with spaces), after the placeholder replacement succeeded.

Common situations: Ask endpoints written without http:// prefix; URLs containing trailing spaces from copy-paste; endpoints valid in old Caddy versions but now strictly validated.

Related errors

• on-demand TLS config conflict: both 'ask' endpoint and a 'pe
• loading on-demand TLS permission module: %v
• preparing 'ask' endpoint: %v
• consolidating TLS connection policies for server %d: %v
• server listening on %v is HTTP, but attempts to configure TL

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/cbfac1f10ebcfce9. Report an issue: GitHub.