gastownhall/beads · error

--proxied-server-external-*: %v

Error message

--proxied-server-external-*: %v

What it means

bd init wraps any failure from cfg.Validate() on the external proxied-server TLS/connection config built from --proxied-server-external-* flags. The %v is the underlying validation error (e.g. missing cert, bad server name, non-positive keep-alive). It signals the flag combination did not form a valid external endpoint config before any workspace side effects occur.

Source

Thrown at cmd/bd/init.go:529

			return fmt.Errorf("--debug cannot be combined with --proxied-server-external-* (debug applies to the managed dolt sql-server only)")
		}
		var externalConfig *configfile.ExternalDoltConfig
		if externalProvided {
			cfg := configfile.ExternalDoltConfig{
				Host:            externalHost,
				Port:            externalPort,
				Socket:          externalSocketPath,
				User:            externalUser,
				TLSRequired:     externalTLS,
				TLSCACert:       externalTLSCACertPath,
				TLSCert:         externalTLSCertPath,
				TLSKey:          externalTLSKeyPath,
				TLSServerName:   externalTLSServerName,
				TLSSkipVerify:   externalTLSSkipVerify,
				KeepAlivePeriod: externalKeepAlive,
			}
			if err := cfg.Validate(); err != nil {
				return fmt.Errorf("--proxied-server-external-*: %v", err)
			}
			externalConfig = &cfg
		}

		// Backend selection: Dolt is the only supported backend.
		if !configfile.IsSupportedBackend(backendFlag) {
			switch backendFlag {
			case configfile.BackendPostgres, configfile.BackendMySQL:
				return fmt.Errorf("storage backend %q is no longer supported: %s; the supported backend is \"dolt\" (default)", backendFlag, configfile.RemovedBackendRationale)
			case configfile.BackendSQLite:
				return fmt.Errorf("storage backend %q is no longer supported: %s; the supported backend is \"dolt\" (default)", backendFlag, configfile.RemovedSQLiteRationale)
			}
			return fmt.Errorf("unknown backend %q: the supported backend is \"dolt\" (default)", backendFlag)
		}
		// A registered extension backend passes IsSupportedBackend so its
		// existing workspaces can be opened, but init provisions Dolt only and
		// would otherwise create the workspace and persist backend: dolt. Reject
		// it here rather than silently creating the wrong workspace; downstream

View on GitHub (pinned to 71377f2769)

Solutions

  1. Read the wrapped %v message to see exactly which field failed validation
  2. Supply both external TLS cert and key paths together, or neither
  3. Verify cert/key files exist and are readable at the given paths
  4. Check that keep-alive / skip-verify flag values are well-formed
  5. If you don't need an external proxied endpoint, drop the --proxied-server-external-* flags entirely

Example fix

// before
bd init --proxied-server-external-tls-key ./key.pem
// after
bd init --proxied-server-external-tls-cert ./cert.pem --proxied-server-external-tls-key ./key.pem
Defensive patterns

Strategy: validation

Validate before calling

if tlsCert != "" && tlsKey == "" {
    return fmt.Errorf("--proxied-server-external-tls-key required when cert is set")
}
if _, err := os.Stat(externalTLSKeyPath); err != nil {
    return fmt.Errorf("external TLS key not readable: %v", err)
}

Try / catch

if err := cfg.Validate(); err != nil {
    return fmt.Errorf("invalid --proxied-server-external-* config: %w", err)
}

Prevention

When it happens

Trigger: Running `bd init` with --proxied-server-external-* flags (cert path, key path, server name, skip-verify, keep-alive) whose assembled proxied.Config fails Validate(), e.g. TLSKey set without TLSCert or invalid keep-alive duration.

Common situations: Typo'd or half-specified TLS flag pairs (cert without key), pointing cert/key paths at nonexistent files, invalid keep-alive values, copy-pasted server-internal flags mixed with external ones.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/a40f4486a40d7184. Report an issue: GitHub.