crowdsecurity/crowdsec · error

while setting trusted_proxies: %w

Error message

while setting trusted_proxies: %w

What it means

NewServer wraps the error from gin's router.SetTrustedProxies when the trusted_proxies list cannot be applied. Gin returns this when any entry is not a valid IP address or CIDR network. The server is not created.

Source

Thrown at pkg/apiserver/apiserver.go:154

	if !log.IsLevelEnabled(log.DebugLevel) {
		gin.SetMode(gin.ReleaseMode)
	}

	router := gin.New()

	router.ForwardedByClientIP = false

	// set the remore address of the request to 127.0.0.1 if it comes from a unix socket
	router.Use(func(c *gin.Context) {
		if c.Request.RemoteAddr == "@" {
			c.Request.RemoteAddr = "127.0.0.1:65535"
		}
	})

	if config.TrustedProxies != nil && config.UseForwardedForHeaders {
		if err = router.SetTrustedProxies(*config.TrustedProxies); err != nil {
			return nil, fmt.Errorf("while setting trusted_proxies: %w", err)
		}

		router.ForwardedByClientIP = true
	}

	gin.DefaultErrorWriter = accessLogger.WriterLevel(log.ErrorLevel)
	gin.DefaultWriter = accessLogger.Writer()

	router.Use(gin.LoggerWithFormatter(func(param gin.LogFormatterParams) string {
		return fmt.Sprintf("%s - [%s] \"%s %s %s %d %s %q %s\"\n",
			param.ClientIP,
			param.TimeStamp.Format(time.RFC1123),
			param.Method,
			param.Path,
			param.Request.Proto,
			param.StatusCode,
			param.Latency,
			param.Request.UserAgent(),

View on GitHub (pinned to 909b515798)

Solutions

1. Check the trusted_proxies entries in your lapi config: each must be a valid IP or CIDR.
2. Remove or fix the offending entry (run crowdsec in debug to see which one gin rejected).
3. Use hostnames via gin's SetTrustedProxies alternative only if your gin version supports them — here it expects IP/CIDR only.
4. If you don't terminate TLS/HTTP behind a proxy, delete the trusted_proxies key entirely.

Example fix

// before
api:
  server:
    trusted_proxies:
      - proxy.internal.example.com
// after
api:
  server:
    trusted_proxies:
      - 10.0.0.0/8
      - 127.0.0.1

// validate trusted proxies before NewServer
for _, p := range cfg.TrustedProxies {
    if net.ParseIP(p) == nil && _, _, err := net.ParseCIDR(p); err != nil {
        return fmt.Errorf("trusted_proxies entry %q is not an IP or CIDR", p)
    }
}

srv, err := NewServer(ctx, cfg, nil)
if err != nil && strings.Contains(err.Error(), "while setting trusted_proxies") {
    log.Fatalf("fix api.server.trusted_proxies entries: %v", err)
}

When it happens

Trigger: NewServer called with config.TrustedProxies set and UseForwardedForHeaders true, and at least one element of the trusted_proxies YAML list fails gin's parse (not an IP/CIDR, or an invalid value like a hostname).

Common situations: Typo in api.server.trusted_proxies (e.g. '10.0.0.0/8x', 'proxy.example.com'); copying an nginx-style hostname into the list; trailing whitespace/yaml quoting issues.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• missing lapi client credentials
• no appsec_config provided
• missing TLS key file
• missing TLS cert file
• group_name is mandatory for CloudwatchSource

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6b6da8cd5b3c2113. Report an issue: GitHub.