crowdsecurity/crowdsec · error

missing allowed_ranges value for api.server.auto_register

Error message

missing allowed_ranges value for api.server.auto_register

What it means

LoadAutoRegister requires an allowed_ranges list when auto_register is enabled: it defines the CIDR ranges from which agents may auto-enroll. A missing (nil) allowed_ranges value aborts config load; each entry is then parsed as CIDR into AllowedRangesParsed.

Source

Thrown at pkg/csconfig/api.go:547

	// Disable by default
	if c.AutoRegister.Enable == nil {
		c.AutoRegister.Enable = new(false)
	}

	if !*c.AutoRegister.Enable {
		return nil
	}

	if c.AutoRegister.Token == "" {
		return errors.New("missing token value for api.server.auto_register")
	}

	if len(c.AutoRegister.Token) < 32 {
		return errors.New("token value for api.server.auto_register is too short (min 32 characters)")
	}

	if c.AutoRegister.AllowedRanges == nil {
		return errors.New("missing allowed_ranges value for api.server.auto_register")
	}

	c.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))

	for _, ipRange := range c.AutoRegister.AllowedRanges {
		_, ipNet, err := net.ParseCIDR(ipRange)
		if err != nil {
			return fmt.Errorf("auto_register: failed to parse allowed range '%s': %w", ipRange, err)
		}

		c.AutoRegister.AllowedRangesParsed = append(c.AutoRegister.AllowedRangesParsed, ipNet)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add allowed_ranges listing trusted CIDRs, e.g. ['192.168.0.0/16','10.0.0.0/8']
2. Restrict ranges to the networks where agents actually run
3. Disable auto_register if agent auto-enrollment is not needed

Example fix

// before
auto_register:
  enable: true
  token: "e3b0c44298fc1c149afbf4c8996fb924"
// after
auto_register:
  enable: true
  token: "e3b0c44298fc1c149afbf4c8996fb924"
  allowed_ranges:
    - 10.0.0.0/8
    - 192.168.0.0/16

if cfg.AutoRegister != nil && cfg.AutoRegister.Enable != nil && *cfg.AutoRegister.Enable && len(cfg.AutoRegister.AllowedRanges) == 0 {
    return errors.New("auto_register enabled without allowed_ranges")
}
for _, r := range cfg.AutoRegister.AllowedRanges {
    if _, _, err := net.ParseCIDR(r); err != nil { return err }
}

if err := serverCfg.LoadAutoRegister(); err != nil {
    return fmt.Errorf("auto_register config: %w", err)
}

When it happens

Trigger: api.server.auto_register.enable: true with api.server.auto_register.allowed_ranges absent (nil); LocalApiServerCfg.LoadAutoRegister() hits the nil check during LAPI config load.

Common situations: Enabling auto_register without thinking about which networks are trusted; templated configs that only set enable and token; docs examples that omit allowed_ranges.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• missing token value for api.server.auto_register
• no listen_uri or listen_socket specified
• no API client section in configuration
• empty cti key
• cannot use TLS with a unix socket

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c2faffaa8d797946. Report an issue: GitHub.