What causes "server secret must be provided for secure confgiuration" in hcengineering/platform?

Set the server secret environment variable expected by FromEnv before starting the service

server secret must be provided for secure confgiuration

Error message

server secret must be provided for secure confgiuration

What it means

The stream service's config loader (FromEnv) rejects configurations where TLS is enabled (Insecure is false) but no ServerSecret was provided. The secret is required to authenticate the upload endpoint in secure mode. Note the message contains a typo ('confgiuration') which is how it usually appears in logs.

Source

Thrown at foundations/stream/internal/pkg/config/config.go:69

// FromEnv creates new Config from env
func FromEnv() (*Config, error) {
	var result Config

	if err := envconfig.Usage("stream", &result); err != nil {
		return nil, err
	}

	if err := envconfig.Process("stream", &result); err != nil {
		return nil, err
	}

	if *result.EndpointURL == (url.URL{}) {
		result.EndpointURL = nil
	}

	if !result.Insecure && result.ServerSecret == "" {
		return nil, errors.New("server secret must be provided for secure confgiuration")
	}

	return &result, nil
}

// Endpoint returns upload address
func (c *Config) Endpoint() *url.URL {
	var scheme = "https"
	if c.Insecure {
		scheme = "http"
	}
	return &url.URL{
		Scheme: scheme,
		Host:   c.EndpointURL.Host,
	}
}

View on GitHub (pinned to 63e28dc964)

Solutions

Set the server secret environment variable expected by FromEnv before starting the service
Or explicitly enable insecure mode (set the INSECURE flag) for local/non-production environments — not recommended for production
Verify with the deployment manifest (env section) that the secret is injected, not an empty string
Fix config plumbing so the secret from the secret manager is actually mapped to the expected env var name

Example fix

// before
STREAM_ENDPOINT_URL=https://stream.example.com
# secret missing
// after
STREAM_ENDPOINT_URL=https://stream.example.com
STREAM_SERVER_SECRET=<secret-value>

Defensive patterns

Strategy: validation

Validate before calling

if os.Getenv("STREAM_INSECURE") != "true" && os.Getenv("STREAM_SERVER_SECRET") == "" {
    panic("STREAM_SERVER_SECRET must be set when secure mode is enabled")
}

Try / catch

cfg, err := config.FromEnv()
if err != nil {
    log.Fatalf("stream config: %v", err) // fails fast at startup
}

Prevention

Fail fast at deploy time: validate required env vars in CI/startup scripts
Document every env var the stream service reads
Never leave secret env vars set to empty strings in manifests
Use secure mode explicitly; set INSECURE only for local dev

When it happens

Trigger: Starting the service with INSECURE=false (or unset, defaulting to secure) while the server-secret env var is empty or missing; FromEnv called from cfg at startup with partial environment.

Common situations: Deploying without setting the secret env var; copying a dev compose file that only sets the endpoint URL; rotating secrets and leaving the variable blank; running locally with secure defaults assumed.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of hcengineering/platform@63e28dc964 (2026-08-29). Data as JSON: /api/errors/675656093518ee38. Report an issue: GitHub.