crowdsecurity/crowdsec · error

plugins are enabled, but the plugin_config section is missin

Error message

plugins are enabled, but the plugin_config section is missing in the configuration

What it means

InitPlugins detects notification plugins referenced by profiles, which requires the plugin broker to know how to spawn plugin processes (user/group, etc.). That configuration lives in the plugin_config section; if it's absent (and the OS is not Windows, where it's unnecessary) initialization fails.

Source

Thrown at pkg/apiserver/apiserver.go:526

	s.controller.PluginChannel = broker.PluginChannel
}

func hasPlugins(profiles []*csconfig.ProfileCfg) bool {
	for _, profile := range profiles {
		if len(profile.Notifications) != 0 {
			return true
		}
	}

	return false
}

func (s *APIServer) InitPlugins(ctx context.Context, cConfig *csconfig.Config, pluginBroker *csplugin.PluginBroker) error {
	if hasPlugins(s.cfg.Profiles) {
		log.Info("initiating plugin broker")
		// On windows, the plugins are always run as medium-integrity processes, so we don't care about plugin_config
		if cConfig.PluginConfig == nil && runtime.GOOS != "windows" {
			return errors.New("plugins are enabled, but the plugin_config section is missing in the configuration")
		}

		if cConfig.ConfigPaths.PluginDir == "" {
			return errors.New("plugins are enabled, but config_paths.plugin_dir is not defined")
		}

		err := pluginBroker.Init(ctx, cConfig.PluginConfig, s.cfg.Profiles, cConfig.ConfigPaths)
		if err != nil {
			return fmt.Errorf("plugin broker: %w", err)
		}

		log.Info("initiated plugin broker")
		s.AttachPluginBroker(pluginBroker)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a plugin_config section to config.yaml, e.g. plugin_config: { user: crowdsec, group: crowdsec }.
2. Remove/disable the notification entries in api.server.profiles if plugins are not actually needed.
3. On containers, ensure the packaged default config includes plugin_config rather than a hand-minimal one.

Example fix

# before
# (no plugin_config section in config.yaml)
# after
plugin_config:
  user: crowdsec
  group: crowdsec

if len(cfg.API.Server.Profiles) > 0 && cfg.PluginConfig == nil {
    return errors.New("profiles use plugins but plugin_config is missing")
}

if err := server.InitPlugins(ctx, cfg, broker); err != nil {
    log.Fatalf("plugin init: %v", err)
}

When it happens

Trigger: api.server.profiles reference notification plugins (e.g. notification/email) while config.yaml lacks the plugin_config: section; usually after hand-writing a minimal config or an incomplete upgrade.

Common situations: Freshly assembled config files copied from docs that omit plugin_config; container images with trimmed configs; disabling plugin_config while still having profiles with notifications.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• missing lapi client credentials
• missing TLS key file
• missing TLS cert file
• plugins are enabled, but config_paths.plugin_dir is not defi
• plugin broker: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/60761963e75bc3dc. Report an issue: GitHub.