What causes "unable to create allowlist: %w" in crowdsecurity/crowdsec?

Read the wrapped %w cause in the error message for the exact DB error

unable to create allowlist: %w

Error message

unable to create allowlist: %w

What it means

CreateAllowList's generic failure path: the insert of the allowlist row failed for any reason other than the name unique constraint. The raw database error is wrapped, so the underlying cause (connection, schema, permission) is preserved in the message chain.

Source

Thrown at pkg/database/allowlists.go:36

	"github.com/crowdsecurity/crowdsec/pkg/database/ent/predicate"
	"github.com/crowdsecurity/crowdsec/pkg/models"
)

const allowlistExpireDecisionsBatchSize = 300

func (c *Client) CreateAllowList(ctx context.Context, name string, description string, allowlistID string, fromConsole bool) (*ent.AllowList, error) {
	allowlist, err := c.Ent.AllowList.Create().
		SetName(name).
		SetFromConsole(fromConsole).
		SetDescription(description).
		SetAllowlistID(allowlistID).
		Save(ctx)
	if err != nil {
		if sqlgraph.IsUniqueConstraintError(err) {
			return nil, fmt.Errorf("allowlist '%s' already exists", name)
		}

		return nil, fmt.Errorf("unable to create allowlist: %w", err)
	}

	return allowlist, nil
}

func (c *Client) DeleteAllowList(ctx context.Context, name string, fromConsole bool) error {
	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole))).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist items: %w", err)
	}

	c.Log.Debugf("deleted %d items from allowlist %s", nbDeleted, name)

	nbDeleted, err = c.Ent.AllowList.
		Delete().
		Where(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole)).
		Exec(ctx)
	if err != nil {

View on GitHub (pinned to 909b515798)

Solutions

Read the wrapped %w cause in the error message for the exact DB error
Verify the database is reachable and migrations are applied (cscli db migrate)
Check INSERT grants on the allowlists table for the DB user
If the cause is a duplicate name, use the distinct 'already exists' handling

Example fix

// before
al, err := client.CreateAllowList(ctx, name, desc, id, false)
// after
al, err := client.CreateAllowList(ctx, name, desc, id, false)
if err != nil {
    return fmt.Errorf("create allowlist: %w", err) // inspect wrapped DB cause
}

Defensive patterns

Strategy: try-catch

Validate before calling

if err := client.Ent.AllowList.Query().Limit(1).Exec(ctx); err != nil {
    return fmt.Errorf("database unavailable: %w", err)
}

Try / catch

al, err := client.CreateAllowList(ctx, name, desc, id, false)
if err != nil {
    if !strings.Contains(err.Error(), "already exists") {
        // generic DB failure: inspect wrapped cause, check DB health
    }
    return err
}

Prevention

Run cscli db migrate after upgrading so the allowlists schema exists
Confirm the DB user has INSERT on allowlists
Verify DB reachability before scripted allowlist creation
Never discard the wrapped error — it contains the root DB cause

When it happens

Trigger: c.CreateAllowList(...) where Save(ctx) fails with a non-unique-constraint error: DB unreachable, schema out of date (missing allowlists table), INSERT permission denied, or context cancelled.

Common situations: Upgrading crowdsec without running cscli db migrate / schema migrations; DB container down when cscli allowlist create runs; read-only DB user.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2efbde6dc0505b3a. Report an issue: GitHub.