dani-garcia/vaultwarden · error

You should not define both

Error message

You should not define both {key} and {key_file}!

What it means

Vaultwarden reads optional config values either directly from the environment variable KEY or from a file path stored in KEY_FILE (a common Docker secrets pattern). This panic fires when both KEY and KEY_FILE are defined for the same key, because the source of truth would be ambiguous.

Solutions

1. Unset the plain env var and keep only KEY_FILE (preferred for secrets)
2. or delete the *_FILE variable and set the value directly in KEY
3. Inspect the container environment (docker exec env / kubectl describe pod) to find where both are defined
4. Remove the duplicate from docker-compose environment/env_file or the image's ENV directives

Example fix

// before
docker run -e ADMIN_TOKEN=secret -e ADMIN_TOKEN_FILE=/run/secrets/admin_token vaultwarden
// after
docker run -e ADMIN_TOKEN_FILE=/run/secrets/admin_token vaultwarden

const K = 'ADMIN_TOKEN';
const hasEnv = K in process.env;
const hasFile = `${K}_FILE` in process.env;
if (hasEnv && hasFile) throw new Error(`Define only one of ${K} or ${K}_FILE`);

function envSource(key) {
  const v = process.env[key], f = process.env[`${key}_FILE`];
  if (v !== undefined && f !== undefined) return null; // conflict
  return v !== undefined ? { kind: 'env', value: v } : f !== undefined ? { kind: 'file', path: f } : { kind: 'absent' };
}

When it happens

Trigger: Calling get_env("X") or get_env_bool("X") when both X and X_FILE are set in the process environment, e.g. DATABASE_URL plus DATABASE_URL_FILE, or ADMIN_TOKEN plus ADMIN_TOKEN_FILE.

Common situations: Docker Compose setups where an env var is inherited from the shell AND a secret file is mounted via env_file; Kubernetes deployments mixing ConfigMap env vars with mounted secret files; lingering exported variables in the container image.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• Failed to load
• Cannot set prototype values
• ConfigInvalid
• msg

AI-assisted analysis of dani-garcia/vaultwarden@cc67d644f6 (2026-09-19). Data as JSON: /api/errors/47b127dc7c5ff414. Report an issue: GitHub.

Appendix: source

Thrown at src/util.rs:440

    T: FromStr,
{
    if let Some(Ok(value)) = string.map(|s| s.as_ref().parse::<T>()) {
        Some(value)
    } else {
        None
    }
}

//
// Env methods
//
pub fn get_env_str_value(key: &str) -> Option<String> {
    let key_file = format!("{key}_FILE");
    let value_from_env = env::var(key);
    let value_file = env::var(&key_file);

    match (value_from_env, value_file) {
        (Ok(_), Ok(_)) => panic!("You should not define both {key} and {key_file}!"),
        (Ok(v_env), Err(_)) => Some(v_env),
        (Err(_), Ok(v_file)) => match std::fs::read_to_string(v_file) {
            Ok(content) => Some(content.trim().to_owned()),
            Err(e) => panic!("Failed to load {key}: {e:?}"),
        },
        _ => None,
    }
}

pub fn get_env<V>(key: &str) -> Option<V>
where
    V: FromStr,
{
    try_parse_string(get_env_str_value(key))
}

pub fn get_env_bool(key: &str) -> Option<bool> {
    const TRUE_VALUES: &[&str] = &["true", "t", "yes", "y", "1"];

View on GitHub (pinned to cc67d644f6)