gastownhall/beads · error

ExternalDoltConfig: TLSKey %q is not absolute

Error message

ExternalDoltConfig: TLSKey %q is not absolute

What it means

ExternalDoltConfig.Validate requires TLSKey to be an absolute path when set. The private key file is loaded together with TLSCert via tls.LoadX509KeyPair in TLSClientConfig; a relative path would resolve against the current working directory and break unpredictably. Validation fails fast before any connection is made.

Source

Thrown at internal/configfile/external_dolt_config.go:74

		return fmt.Errorf("ExternalDoltConfig: Port %d out of range [1, 65535]", c.Port)
	}

	if hasSocket && !filepath.IsAbs(c.Socket) {
		return fmt.Errorf("ExternalDoltConfig: Socket %q is not absolute", c.Socket)
	}

	switch {
	case c.TLSCert != "" && c.TLSKey == "":
		return errors.New("ExternalDoltConfig: TLSCert set without TLSKey")
	case c.TLSCert == "" && c.TLSKey != "":
		return errors.New("ExternalDoltConfig: TLSKey set without TLSCert")
	}

	if c.TLSCert != "" && !filepath.IsAbs(c.TLSCert) {
		return fmt.Errorf("ExternalDoltConfig: TLSCert %q is not absolute", c.TLSCert)
	}
	if c.TLSKey != "" && !filepath.IsAbs(c.TLSKey) {
		return fmt.Errorf("ExternalDoltConfig: TLSKey %q is not absolute", c.TLSKey)
	}
	if c.TLSCACert != "" && !filepath.IsAbs(c.TLSCACert) {
		return fmt.Errorf("ExternalDoltConfig: TLSCACert %q is not absolute", c.TLSCACert)
	}

	if !c.TLSRequired {
		switch {
		case c.TLSCACert != "":
			return errors.New("ExternalDoltConfig: TLSCACert set without TLSRequired")
		case c.TLSCert != "" || c.TLSKey != "":
			return errors.New("ExternalDoltConfig: TLSCert/TLSKey set without TLSRequired")
		case c.TLSServerName != "":
			return errors.New("ExternalDoltConfig: TLSServerName set without TLSRequired")
		case c.TLSSkipVerify:
			return errors.New("ExternalDoltConfig: TLSSkipVerify set without TLSRequired")
		}
	}

View on GitHub (pinned to 71377f2769)

Solutions

1. Set TLSKey to an absolute path, e.g. "/etc/beads/tls/client.key".
2. Expand "~/" and $VARS before storing the value in config.
3. If client cert auth is not required, clear both TLSCert and TLSKey.

Example fix

// before
tlsKey: "certs/client.key"
// after
tlsKey: "/etc/beads/tls/client.key"

func validTLSKey(cfg configfile.ExternalDoltConfig) error {
    if cfg.TLSKey != "" && !filepath.IsAbs(cfg.TLSKey) {
        return fmt.Errorf("TLSKey must be absolute: %q", cfg.TLSKey)
    }
    return nil
}

When it happens

Trigger: Calling Validate (via NewExternalDoltServer, NewExternalDoltServerUOWProvider, or buildProxiedServerClientInfo) with TLSKey set to a relative path such as "certs/client.key" or an unexpanded "~/certs/client.key".

Common situations: Same as TLSCert: tilde paths that Go does not expand, configs copied between machines, or running the binary from a different working directory than intended.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• ExternalDoltConfig: TLSCert %q is not absolute
• ExternalDoltConfig: TLSCACert %q is not absolute
• ExternalDoltConfig: Socket %q is not absolute
• server: NewDoltServer: doltBinExec is required
• server: NewDoltServer: rootDir is required

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/8e4ecb4c2eefd259. Report an issue: GitHub.