AutoConf cannot use the default mainnet URL (%s) on a privat

Error message

AutoConf cannot use the default mainnet URL (%s) on a private network (swarm.key or LIBP2P_FORCE_PNET detected). Either disable AutoConf by setting AutoConf.Enabled=false, or configure AutoConf.URL to point to a configuration service specific to your private swarm

What it means

ValidateAutoConfWithRepo refuses to start when the node is on a private network (a swarm.key exists or LIBP2P_FORCE_PNET is set) while AutoConf is enabled with the default mainnet URL. Fetching shared publicnet configuration would leak or misconfigure a private swarm, so kubo forces an explicit choice: disable AutoConf or point AutoConf.URL at a private configuration service.

Source

Thrown at config/autoconf_client.go:73

		autoconf.WithRefreshInterval(refreshInterval.WithDefault(DefaultAutoConfRefreshInterval)),
		autoconf.WithFallback(autoconf.GetMainnetFallbackConfig),
		autoconf.WithURL(url),
	}

	return autoconf.NewClient(options...)
}

// ValidateAutoConfWithRepo validates that autoconf setup is correct at daemon startup with repo access
func ValidateAutoConfWithRepo(cfg *Config, swarmKeyExists bool) error {
	if !cfg.AutoConf.Enabled.WithDefault(DefaultAutoConfEnabled) {
		// AutoConf is disabled, check for "auto" values and warn
		return validateAutoConfDisabled(cfg)
	}

	// Check for private network with default mainnet URL
	url := cfg.AutoConf.URL.WithDefault(DefaultAutoConfURL)
	if swarmKeyExists && url == DefaultAutoConfURL {
		return fmt.Errorf("AutoConf cannot use the default mainnet URL (%s) on a private network (swarm.key or LIBP2P_FORCE_PNET detected). Either disable AutoConf by setting AutoConf.Enabled=false, or configure AutoConf.URL to point to a configuration service specific to your private swarm", DefaultAutoConfURL)
	}

	// Further validation will happen lazily when config is accessed
	return nil
}

// validateAutoConfDisabled checks for "auto" values when AutoConf is disabled and logs errors
func validateAutoConfDisabled(cfg *Config) error {
	hasAutoValues := false
	var errors []string

	// Check Bootstrap
	if slices.Contains(cfg.Bootstrap, AutoPlaceholder) {
		hasAutoValues = true
		errors = append(errors, "Bootstrap contains 'auto' but AutoConf.Enabled=false")
	}

	// Check DNS.Resolvers

View on GitHub (pinned to 329838acdf)

Solutions

Set AutoConf.Enabled=false in the config
Configure AutoConf.URL to your private swarm's configuration service endpoint
Remove swarm.key / unset LIBP2P_FORCE_PNET if the node was not meant to be private
Ensure the private config value is persisted with: ipfs config AutoConf.URL '<private-url>'

Example fix

// before
ipfs --repo-dir /pnet daemon   # swarm.key present, AutoConf default URL
// after
ipfs config AutoConf.Enabled false
# or
ipfs config AutoConf.URL 'https://conf.private-swarm.example'
ipfs --repo-dir /pnet daemon

Defensive patterns

Strategy: validation

Validate before calling

private := swarmKeyExists() || os.Getenv("LIBP2P_FORCE_PNET") != ""
url := cfg.AutoConf.URL.WithDefault(config.DefaultAutoConfURL)
if private && url == config.DefaultAutoConfURL { cfg.AutoConf.Enabled = false }

Try / catch

if err := config.ValidateAutoConfWithRepo(repoPath); err != nil { return fmt.Errorf("daemon startup blocked by AutoConf policy: %w", err) }

Prevention

When deploying a private swarm, immediately set AutoConf.Enabled=false in the base config
Never combine LIBP2P_FORCE_PNET with default AutoConf settings in CI or containers
Audit config templates after copying from public-net setups

When it happens

Trigger: Starting the daemon (via daemonFunc) with AutoConf.Enabled=true and the default AutoConf.URL while repo/swarm.key is present or LIBP2P_FORCE_PNET=1 is set.

Common situations: Operator runs a private IPFS swarm (cluster, airgapped network) copied from a public-net config that has AutoConf left at defaults; CI sets LIBP2P_FORCE_PNET for tests without disabling AutoConf.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/9e8aa39424b114a0. Report an issue: GitHub.