bootstrap service ' ' cannot be both masked and enabled

Error message

bootstrap service '{name}' cannot be both masked and enabled

What it means

Masking a unit also disables it, so masked=true combined with enabled=true is contradictory. mise rejects this combination when constructing the Service resource from TOML to avoid undefined or unsafe apply behavior.

Solutions

Set enabled = false (or drop the line) when masked = true, since masking already prevents enabling
Remove masked = true if you actually want the service enabled
Use masked + enabled=false deliberately to fully lock a unit

Example fix

# before
[bootstrap.services.myunit]
masked = true
enabled = true
# after
[bootstrap.services.myunit]
masked = true
enabled = false

Defensive patterns

Strategy: validation

Validate before calling

if svc.masked && svc.enabled {
    eprintln!("{}: masked and enabled are mutually exclusive", svc.name);
}

Prevention

To disable a service permanently, prefer masked = true with enabled omitted/false
Do not add masked=true on top of an already-enabled service as a 'kill switch'
Validate service tables whenever configs are merged or templated

When it happens

Trigger: Loading a config where a [bootstrap.services.*] table sets masked = true together with enabled = true.

Common situations: An existing enabled service that someone added masked = true to in order to 'turn off', instead of disabling it; template or copied config blocks carrying both flags.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/4f124b267256cd9f. Report an issue: GitHub.

Appendix: source

Thrown at src/system/services.rs:125

}

impl ServiceRequest {
    #[cfg(test)]
    fn from_toml(name: String, config: ServiceTomlConfig) -> Result<Self> {
        Self::from_toml_with_origin(name, config, None)
    }

    fn from_toml_with_origin(
        name: String,
        config: ServiceTomlConfig,
        origin: Option<ResourceOrigin>,
    ) -> Result<Self> {
        let unit = normalize_unit_name(&name)?;
        if config.masked && config.state == ServiceState::Running {
            bail!("bootstrap service '{name}' cannot be both masked and running");
        }
        if config.masked && config.enabled {
            bail!("bootstrap service '{name}' cannot be both masked and enabled");
        }
        Ok(Self {
            name,
            unit,
            state: config.state,
            enabled: config.enabled,
            masked: config.masked,
            on_change: config.on_change,
            origin,
            inspection: None,
        })
    }

    pub(crate) fn plan(&self) -> ResourcePlan {
        let id = ResourceId::new("service", &self.name);
        let desired = self.desired();
        let Some(inspection) = &self.inspection else {
            return self.with_origin(ResourcePlan::new(

View on GitHub (pinned to 533346cc37)