caddyserver/caddy · error

%s is invalid policy

Error message

%s is invalid policy

What it means

loadECHConfig could not load the ECH config bytes (config.bin) from storage, and the cleanup delete of the config folder also failed. Same double-failure shape as the key.bin case: the per-config recovery path assumes deletes work, and they did not.

Source

Thrown at modules/caddyhttp/proxyprotocol/policy.go:78

func (x Policy) MarshalText() ([]byte, error) {
	return []byte(policyMap[x]), nil
}

// UnmarshalText implements the text unmarshaller method.
func (x *Policy) UnmarshalText(text []byte) error {
	name := string(text)
	tmp, err := parsePolicy(name)
	if err != nil {
		return err
	}
	*x = tmp
	return nil
}

func parsePolicy(name string) (Policy, error) {
	if x, ok := policyMapRev[strings.ToUpper(name)]; ok {
		return x, nil
	}
	return Policy(0), fmt.Errorf("%s is %w", name, errInvalidPolicy)
}

var errInvalidPolicy = errors.New("invalid policy")

View on GitHub (pinned to 50e54ee279)

Solutions

1. Fix storage read/write availability first; the error only clears when deletes can succeed.
2. Remove the reported ech/configs/<id> folder manually after storage is writable, then restart.
3. Keep the whole ech/configs tree under one writable, consistent storage backend.

Parse the named cfgIDKey from the error, restore storage write access, manually remove that folder, and restart — the load path then regenerates the config.

When it happens

Trigger: storage.Load of config.bin errors AND storage.Delete of the folder errors — read-only storage, backend outage, or permissions preventing both operations.

Common situations: Read-only data volumes; storage corruption affecting config.bin; storage backends where child-key deletion is disallowed while listing works.

Related errors

• protocol argument was not a string
• ErrInvalidSplitPath
• rfc9112 forbids empty Host
• private key does not match issuer public key
• --input is required

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/575c37a10c45602e. Report an issue: GitHub.