ErrLookup › juanfont/headscale

juanfont/headscale

An open source, self-hosted implementation of the Tailscale control server · Go · 183 source files

Analyzed at 565fd254d0 on 2026-08-15. 652 documented errors.

Code / Message	Type	Severity	Tags
health check timed out	console	warning	http, debug, access-control, network, reverse-proxy
empty auth key in response	console	warning	http, debug, form-parsing, payload-limit
MOCKOIDC_CLIENT_ID not defined	validation	error	http, internal-error, logging, go
MOCKOIDC_CLIENT_SECRET not defined	validation	error	network, noise, websocket, reverse-proxy, registration
MOCKOIDC_PORT not defined	validation	error	versioning, noise, client-compatibility, registration
command aborted by user	console	info	http, noise, not-implemented, protocol
--name or --identifier flag is required	validation	warning	http, method-not-allowed, ping, noise
HEADSCALE_CLI_API_KEY environment variable needs to be set	validation	warning	http, validation, ping, query-params
missing parameters	validation	warning	http, ping, expiry, one-time-token, state
test failed	console	error	integration, api-misuse, user-management
unexpected end of container wait	console	warning	integration, http, cookiejar, oidc, defensive
no docker context found	console	error	integration, http, nil-guard, api-misuse
system checks failed	console	error	integration, http, nil-guard, api-misuse
unknown --set value (want must\|all)	validation	warning	integration, http, url-parsing, defensive
test pattern is required as first argument or use --test fla	validation	error	integration, http, network, oidc, login
directory is required	validation	error	integration, http, network, transient
auth request rejected	http	error	integration, http, redirect, oidc, config
not confirmed, aborting	http	error	integration, http, oidc, login, status-code
tag must start with the string 'tag:'	validation	error	integration, http, oidc, login, status-code
tag should be lowercase	validation	error	integration, oidc, html-parsing, login, template
STUN address not set	validation	critical	config, derp, stun, startup, headscale
initial DERPMap is empty, Headscale requires at least one en	validation	critical	config, derp, relay, startup, headscale
failed to parse ApiKey	exception	error	api-key, authentication, validation, headscale, go
failed to generate API key	exception	error	api-key, entropy, crypto-rand, headscale, go
database type not supported	validation	critical	config, database, startup, headscale
foreign key constraints violated	exception	critical	database, sqlite, migration, data-integrity, headscale
failed to allocate IP	exception	error	ip-allocation, capacity, config, node-registration, headscale
node name is not unique	validation	warning	node, naming, dns, conflict, headscale
node not found	exception	warning	node, not-found, database, headscale, go
route is not available on node	validation	warning	routes, subnet, node, headscale
failed to convert node interface	exception	error	node, database, serialization, keys, headscale
failed to parse oauth client secret	exception	error	oauth, authentication, validation, headscale, go
failed to parse oauth access token	exception	error	oauth, access-token, authentication, validation, headscale
oauth access token expired	exception	warning	oauth, access-token, expiration, authentication, headscale
auth-key expired	validation	warning	preauth-key, registration, expiration, headscale
auth-key has already been used	http	warning	preauth-key, registration, single-use, headscale
user mismatch	http	warning	preauth-key, user, registration, authorization, headscale
failed to parse auth-key	http	error	preauth-key, validation, registration, headscale, go
path cannot be empty	validation	critical	sqlite, config, validation, database, headscale
busy_timeout must be >= 0	validation	error	sqlite, config, validation, busy-timeout, headscale
invalid journal_mode	validation	error
invalid auto_vacuum	validation	error
wal_autocheckpoint must be >= -1	validation	error
invalid synchronous	validation	error
user already exists	exception	error
user not found	exception	error
user not empty: node(s) found	exception	error
cannot edit OIDC user	exception	error
version upgrade not supported	console	error
version downgrade not supported	console	error
major version change not supported	console	error
cannot parse version	console	error
version does not follow semver major.minor.patch format	console	error
path is a directory, only file is supported	validation	error
machines registered with CLI do not support expiry	http	error
unsupported client version	http	error
missing URL parameter	http	error
no auth session found	http	error
ssh action: unknown dst node id	http	error
ssh action: noise session machine key does not match dst nod	http	error
ssh action: cached auth session is not an SSH-check binding	http	error	ssh, noise, auth, headscale
ssh action: cached binding does not match request src/dst	http	error	ssh, security, auth, headscale
oidc state parameter is too short	http	warning	oidc, auth, http, headscale
empty OIDC callback params	http	warning	oidc, auth, http, headscale
extracting ID token	http	error	oidc, auth, config, headscale
registration info not in cache	http	error	oidc, pkce, cache, auth, headscale
authenticated principal is not in any allowed group	http	error	oidc, authorization, config, headscale
authenticated principal has an unverified email	http	error	oidc, authorization, email, headscale
invalid action	validation	error	policy, acl, config, headscale
tag owner is not an Alias	validation	error	policy, internal, invariant, headscale
test(s) failed	validation	error	policy, acl, validation, headscale
autogroup:self requires per-node resolution and cannot be re	validation	error	policy, autogroup, config, headscale
references undefined tag	validation	error	policy, tags, config, headscale
tags in SSH source cannot access user-owned devices	validation	error	policy, ssh, validation, headscale
user destination requires source to contain only that same u	validation	error	policy, ssh, validation, headscale
autogroup:self destination requires source to contain only u	validation	error	policy, ssh, autogroup, validation, headscale
tags in SSH source cannot access autogroup:member (user-owne	validation	error	policy, ssh, autogroup, validation, headscale
wildcard (*) is not supported as SSH destination	validation	error	policy, ssh, validation, config, headscale
is above the max (168h)	validation	error	policy, ssh, validation, config, headscale
must be a positive duration	validation	error	policy, ssh, configuration, validation, go
checkPeriod is only valid with action "check"	validation	error	policy, ssh, configuration, validation, go
invalid localpart format, must be localpart:*@<domain>	validation	error	policy, ssh, localpart, configuration, validation, go
users must be specified	validation	error	policy, ssh, configuration, validation, go
is not valid	validation	error	policy, ssh, users, configuration, validation, go
action must be specified	validation	error	policy, ssh, configuration, validation, go
invalid dst	validation	error	policy, ssh, dst, configuration, validation, go
nodeAttrs target does not support this autogroup	validation	error	headscale, policy, acl, autogroup, nodeattrs, validation
nodeAttrs uses a feature headscale does not yet support	validation	error	headscale, policy, nodeattrs, funnel, unsupported-feature
nodeAttrs ipPool requires the IP allocator (https://github.c	validation	error	headscale, policy, nodeattrs, ippool, unsupported-feature
username must contain @	validation	error	headscale, policy, username, acl, validation
user not found	validation	error	headscale, policy, users, oidc, validation
multiple users found	validation	error	headscale, policy, users, ambiguity, oidc
group must start with 'group:'	validation	error	headscale, policy, groups, acl, validation
tag must start with 'tag:'	validation	error	headscale, policy, tags, acl, validation
invalid hostname	validation	error	headscale, policy, hostname, acl, validation
error resolving host	validation	error	headscale, policy, hosts, acl, dns
invalid prefix	validation	error	headscale, policy, cidr, prefix, validation
invalid autogroup	validation	error	headscale, policy, autogroup, acl, validation
unknown autogroup	validation	error	headscale, policy, autogroup, version-skew, validation
hostport must contain a colon	validation	error	headscale, policy, acl, hostport, validation
type not supported	validation	error	headscale, policy, json, acl, type-error
invalid alias format	validation	error	headscale, policy, alias, acl, validation
invalid auto approver format	validation	error	headscale, policy, autoapprovers, routes, validation
invalid owner format	validation	error	headscale, policy, tagowners, acl, validation
invalid group member type	validation	error	headscale, policy, groups, json, validation
group value must be an array of users	validation	error	policy, json, validation, headscale, groups
hostname contains invalid IP address	validation	error	policy, json, dns, ip-address, validation
tag not found	validation	error	policy, tags, validation, acl, headscale
auto approver is not an alias	validation	error	policy, internal, invariant, autoapprovers, go
invalid ACL action	validation	error	policy, acl, validation, json
invalid SSH action	validation	info	policy, ssh, dead-code, sentinel, go
invalid protocol number	validation	error	policy, acl, protocol, validation
leading 0 not permitted in protocol number	validation	error	policy, acl, protocol, validation
protocol number out of range (0-255)	validation	error	policy, acl, protocol, validation
autogroup not supported in headscale	validation	info	policy, autogroup, dead-code, sentinel
autogroup:internet can only be used in ACL destinations	validation	error	policy, autogroup, acl, ssh, validation
"autogroup:self" not valid on the src side of a rule	validation	error	policy, autogroup, acl, validation
autogroup not supported for ACL sources	validation	error	policy, autogroup, acl, validation
autogroup not supported for ACL destinations	validation	error	policy, autogroup, acl, validation
cannot use autogroup:danger-all as a dst	validation	error	policy, autogroup, acl, security, validation
autogroup not supported for SSH sources	validation	error	policy, autogroup, ssh, validation
autogroup not supported for SSH destinations	validation	error	policy, autogroup, ssh, validation
host not defined in policy	validation	error	policy, hosts, acl, validation
alias not supported for SSH source	validation	error	policy, ssh, validation, json
alias not supported for SSH destination	validation	error	policy, ssh, validation, json
unknown field	validation	error	policy, hujson, config, validation
protocol does not support specific ports	validation	error	policy, acl, protocol, ports, validation
test entry must have at least one of "accept" or "deny"	validation	error	policy, tests, validation
test protocol must be tcp, udp, sctp, or empty	validation	error	policy, tests, protocol, validation
test destination port must be a single port	validation	error	policy, tests, ports, validation
test destination must be a single host, not a CIDR range	validation	error	policy, tests, cidr, hosts, validation
autogroup:internet not valid as a test destination	validation	error	policy, tests, autogroup, exit-node
SSH tests entry must have a non-empty src	validation	error	policy, ssh, tests, validation
SSH tests entry must have at least one dst	validation	error	policy, ssh, tests, validation
SSH tests dst contains unknown tag	validation	error	policy, ssh, tests, tags, validation
proto name "*" not known; use protocol number 0-255 or proto	validation	error	policy, acl, protocol, wildcard, validation
input must contain a colon character separating destination	validation	error	policy, acl, parsing, ports
input cannot start with a colon character	validation	error	policy, acl, parsing, ports
input cannot end with a colon character	validation	error	policy, acl, parsing, ports
invalid port range format	validation	error	policy, acl, parsing, port-range
invalid port range: first port is greater than last port	validation	error	policy, acl, parsing, port-range
first port must be >0, or use '*' for wildcard	validation	error	policy, acl, parsing, ports
invalid first integer	validation	error	policy, acl, parsing, ports
port number out of range	validation	error	policy, acl, parsing, ports
given name already in use by another node	http	error	state, dns, rename, node, uniqueness
unsupported policy mode	validation	error	headscale, config, policy, startup
node not found	http	error	headscale, node, not-found, api
node no longer exists in NodeStore	http	error	headscale, node, race, nodestore, concurrency
node name is not unique	http	error	headscale, node, naming, conflict, api
registration expired	http	error	headscale, registration, auth, timeout, cache
node key already in use by another machine	http	error	headscale, registration, node-key, conflict, cloning
machine key maps to ambiguous node ownership	http	error	headscale, registration, ownership, tags, data-integrity
node marked as tagged but has no tags	http	error	headscale, tags, ownership, validation
node has neither user nor tags - must be owned by user or ta	http	error	headscale, ownership, validation, data-integrity
requested tags	http	error	headscale, tags, policy, acl, registration
no cert domains available for HTTPS	console	warning	headscale, tailsql, tls, https, magicdns
auth ID has invalid length	validation	error	headscale, auth, registration, validation
auth ID has invalid prefix	validation	error	headscale, auth, registration, validation
oidc_client_secret and oidc_client_secret_path are mutually	validation	error	headscale, config, oidc, secrets
oidc.issuer must be a valid http(s) URL	validation	error	headscale, config, oidc, url-validation
oidc.client_id is required when oidc.issuer is set	validation	error	headscale, config, oidc, validation
oidc.client_secret or oidc.client_secret_path is required wh	validation	error	headscale, config, oidc, secrets, validation
server_url cannot be part of base_domain in a way that could	validation	error	headscale, config, dns, magicdns, networking
server_url cannot use the same domain as base_domain in a wa	validation	error	headscale, config, dns, magicdns, networking
pkce.method must be either 'plain' or 'S256'	validation	error	headscale, config, oidc, pkce, validation
0.0.0.0/0 and ::/0 are not allowed	validation	error	config, networking, validation, reverse-proxy
no IPv4 or IPv6 prefix configured, minimum one prefix is req	validation	critical	config, ip-allocation, validation, startup
Fatal config error: %s	validation	critical	config, validation, startup, aggregated-error
cannot remove all tags from node	validation	error	tags, node-ownership, state, api
update is disabled for modes other than 'database'	http	error	policy, acl, api, config
username must be at least 2 characters long	validation	warning	validation, username, dns, users
username must start with a letter	validation	warning	validation, username, dns, users
username cannot contain more than one '@'	validation	warning	validation, username, dns, users
creating directory failed with permission error	console	error	filesystem, permissions, startup, config
creating temp dir: %w	console	error	dev-tooling, filesystem, temp-dir, environment
writing config: %w	console	error	dev-tooling, filesystem, config, environment
building headscale: %w	console	error	dev-tooling, build, go-toolchain, compile
starting headscale: %w	console	error	dev-tooling, process, exec, environment
waiting for headscale: %w	console	error	dev-tooling, health-check, startup, timeout
creating user: %w	console	error	dev-tooling, cli, users, provisioning
parsing user: %w	console	error	dev-tooling, json, parsing, version-skew
creating pre-auth key: %w	console	error	dev-tooling, cli, preauthkey, provisioning
parsing pre-auth key: %w	console	error	dev-tooling, json, parsing, version-skew
headscale exited: %w	console	error	dev-tooling, process, runtime-crash, supervision
creating request: %w	console	warning	dev-tooling, http, health-check, context-cancellation
unmarshalling user JSON: %w (raw: %s)	console	error	json, cli, dev-tooling, go
unmarshalling key JSON: %w (raw: %s)	console	error	json, cli, dev-tooling, go
listing api keys: %w	console	error	network, http-client, cli, go
creating api key: %w	console	error	network, http-client, cli, go
either --id or --prefix must be provided: %w	validation	warning	cli, validation, flags, go
only one of --id or --prefix can be provided: %w	validation	warning	cli, validation, flags, go
expiring api key: %w	console	error	network, http-client, cli, go
deleting api key: %w	console	error	network, http-client, cli, go
%w: api key %d not found	validation	warning	cli, not-found, validation, go
registering node: %w	console	error	network, http-client, cli, registration, go
approving auth request: %w	console	error	network, http-client, cli, auth, go
rejecting auth request: %w	console	error	network, http-client, cli, auth, go
configuration error: %w	console	error	configuration, yaml, cli, startup, go
parsing machine key: %w	console	warning	cli, validation, debug, go
creating node: %w	console	error	network, http-client, cli, debug, go
dumping config: %w	console	warning	filesystem, configuration, integration-test, go
marshalling machine key: %w	console	error	crypto, key-generation, unreachable-defensive, go
checking health: %w	console	error	network, healthcheck, cli, go
running mock OIDC server: %w	console	error	oidc, testing, environment, server, go
unmarshalling users: %w	console	error
registering node: %w	console	error
listing nodes: %w	console	error
converting to table: %w	console	error
disabling node expiry: %w	console	error
parsing expiry time: %w	console	error
expiring node: %w	console	error
renaming node: %w	console	error
getting node: %w	console	error
deleting node: %w	console	error
backfilling IPs: %w	console	error
setting tags: %w	console	error
setting approved routes: %w	console	error
at least one --scope is required: %w	validation	error
creating oauth client: %w	console	error
listing oauth clients: %w	console	error
--id is required: %w	validation	error
deleting oauth client: %w	console	error
loading configuration: %w	console	error
api error (%d): %s	http	error	api, http, cli, oauth
loading config: %w	console	error	config, cli, database, bypass
opening database: %w	console	error	database, cli, bypass, sqlite, postgres
loading policy from database: %w	console	error	database, policy, cli, bypass
loading ACL policy: %w	console	error	network, http, cli, policy
reading policy file: %w	console	error	filesystem, cli, policy
loading users for policy validation: %w	console	error	database, policy, cli, bypass
parsing policy file: %w	console	error	policy, validation, cli, hujson
setting ACL policy: %w	console	error	database, policy, cli, bypass
loading users: %w	console	error	database, policy, cli, bypass
loading nodes: %w	console	error	database, policy, cli, bypass
listing preauthkeys: %w	console	error	network, http, cli, preauthkeys
creating preauthkey: %w	console	error	network, http, cli, preauthkeys
missing --id parameter: %w	validation	error	cli, validation, preauthkeys
expiring preauthkey: %w	console	error	network, http, cli, preauthkeys
deleting preauthkey: %w	console	error	network, http, cli, preauthkeys
initializing: %w	console	error
headscale ran into an error and had to shut down: %w	console	error
listing users: %w	console	error
invalid picture URL: %w	validation	error
creating user: %w	console	error
destroying user: %w	console	error
renaming user: %w	console	error
%w: %d %s	http	error
%w: %s	http	error
loading configuration: %w	console	error
creating new headscale: %w	console	error
connecting to headscale: %w	console	error
unable to read/write to headscale socket %q, do you have the	console	error
marshalling JSON output: %w	console	error
marshalling JSON-line output: %w	console	error
marshalling YAML output: %w	console	error
parsing duration: %w	validation	error	cli, flag-parsing, duration, headscale
cleaning stale test containers: %w	console	error	docker, integration-tests, cleanup, hi
pruning networks: %w	console	error	docker, networks, cleanup, integration-tests
removing test container: %w	console	warning	docker, container-removal, teardown, integration-tests
cleaning up containers for run %s: %w	console	warning	docker, labels, teardown, integration-tests
creating Docker client: %w	console	error	docker, client-init, environment, hi
listing containers: %w	console	error	docker, container-list, api, hi
listing containers for run %s: %w	console	warning	docker, container-list, labels, integration-tests
listing stopped containers: %w	console	error	docker, container-list, filters, pre-test-cleanup
listing images: %w	exception	error	docker, images, container-list, cleanup
reading logs directory: %w	exception	error	filesystem, cleanup, logs, hi
creating Docker client: %w	exception	critical	docker, client-init, integration-tests, hi
getting absolute path for logs directory: %w	exception	error	filesystem, working-directory, integration-tests, hi
creating logs directory: %w	exception	error	filesystem, permissions, logs, integration-tests
ensuring image availability: %w	exception	error	docker, image-pull, integration-tests, hi-runner, network
creating container: %w	exception	error	docker, container-create, hi-runner, integration-tests
starting container: %w	exception	error	docker, container-start, port-conflict, hi-runner
test failed: %d %w	exception	error	memory, resource-limits, stats, hi-runner, performance
executing test: %w	exception	error	docker, container-wait, streaming, hi-runner, flaky
%w: exit code %d	exception	error	go-test, assertion-failure, integration-tests, hi-runner
getting working directory: %w	exception	error	filesystem, os, working-directory, hi-runner
getting container logs: %w	exception	error	docker, container-logs, streaming, hi-runner
waiting for container: %w	exception	error	docker, container-wait, cancellation, hi-runner
listing containers: %w	exception	warning	docker, container-list, finalization, hi-runner
getting docker context: %w	exception	error	docker, docker-context, cli, environment, hi-runner
parsing docker context: %w	exception	error	docker, json, docker-context, version-compatibility
inspecting image %s: %w	exception	error	docker, image-inspect, permissions, daemon
checking local image availability: %w	exception	error	docker, image-inspect, readiness, daemon
resolving registry auth: %w	exception	error	docker, registry-auth, credentials, configuration
pulling image %s: %w	exception	error	docker, image-pull, rate-limit, network, retry
reading pull output: %w	exception	error	docker, image-pull, streaming, network
extracting logs: %w	exception	warning	docker, logging, integration-tests, hi-runner
demultiplexing container logs: %w	exception	warning	docker, stdcopy, logging, stream-demux
writing stdout log: %w	exception	error	filesystem, disk-full, logging, integration-tests
writing stderr log: %w	exception	error	filesystem, disk-full, logging, integration-tests
%w - see details above	exception	error	hi-runner, pre-flight, docker, environment-checks
%w: %q	validation	error	hi-runner, cli-flags, validation, capver
pre-flight checks failed: %w	exception	error	hi-runner, pre-flight, docker, integration-tests
creating Docker client: %w	exception	error	docker, docker-sdk, configuration, env-vars
reading map responses from directory: %w	exception	error	mapresponses, json, filesystem, integration-tests
marshaling expected online map: %w	exception	warning	json, mapresponses, serialization
go mod vendor: %w	exception	error	go-modules, tooling, vendorhash, build
reading or creating Noise protocol private key: %w	console	critical	noise, crypto-keys, filesystem, permissions, startup
init state: %w	console	critical	startup, database, state, migrations, configuration
building trusted_proxies middleware: %w	console	critical	configuration, http-middleware, network, startup, cidr
reading or creating DERP server private key: %w	console	critical	derp, crypto-keys, filesystem, permissions, startup
DERP server private key and noise private key are the same:	console	critical	derp, noise, crypto-keys, configuration, startup
getting DERPMap: %w	console	critical	derp, derpmap, network, configuration, startup
setting up extrarecord manager: %w	console	error	dns, configuration, json, fsnotify, startup
removing old socket file: %w	console	critical	unix-socket, filesystem, startup, permissions
setting up unix socket: %w	console	critical	unix-socket, filesystem, startup, permissions, containers
setting up socket: %w	console	critical	unix-socket, network, startup, filesystem
changing socket permission: %w	console	critical	unix-socket, filesystem, permissions, startup, race-condition
configuring TLS settings: %w	console	critical	tls, certificates, startup, configuration, lets-encrypt
binding to TCP address: %w	console	critical	network, tcp, startup, configuration, ports
ensuring private key directory: %w	console	critical	filesystem, permissions, crypto-keys, startup
converting private key to string for saving: %w	console	error	crypto-keys, internal, startup, unreachable-in-practice
saving private key to disk at path %q: %w	console	critical	crypto-keys, filesystem, permissions, disk-space, startup
reading private key file: %w	console	critical	crypto-keys, filesystem, permissions, startup
parsing private key: %w	console	critical	crypto-keys, configuration, data-corruption, startup
handling logout: %w	exception	error	authentication, logout, database, registration
handling existing node: %w	exception	error	authentication, logout, database, registration
handling register with auth key: %w	exception	error	authentication, preauth-key, registration, database
handling register interactive: %w	exception	error	authentication, registration, interactive-login, database
deleting ephemeral node: %w	exception	error	ephemeral-nodes, logout, database, registration
setting node expiry: %w	exception	error	logout, database, node-expiry, registration
auto approving routes: %w	exception	error	routes, auto-approval, registration, database, policy
generating registration ID: %w	exception	error	authentication, registration, entropy, containers, unreachable-in-practice
saving API key to database: %w	http	error	database, gorm, api-key, sqlite, bcrypt
failed to parse ApiKey: invalid display prefix format	validation	warning	api-key, validation, dead-code, parsing
failed to parse ApiKey: prefix too short	validation	warning	api-key, validation, parsing, user-input
failed to parse ApiKey: prefix contains invalid characters	validation	warning	api-key, validation, base64url, user-input
version check: %w	console	critical	database, migration, versioning, startup
automigrating types.Route: %w	console	critical	database, migration, gorm, sqlite, startup
automigrating types.PreAuthKey: %w	console	critical	database, migration, gorm, preauth-key, foreign-key
automigrating types.Node: %w	exception	critical	database, migration, gorm, node, sqlite
setting auth_key to null on nodes with non-existing keys: %w	exception	critical	database, migration, sql, locking, sqlite
adding column types.Node: %w	exception	critical	database, migration, ddl, routes, sqlite
fetching routes: %w	exception	critical	database, migration, routes, scan, postgres
saving approved routes to new column: %w	exception	critical	database, migration, routes, json, update
listing users: %w	exception	critical	database, migration, user, oidc, gorm
saving user: %w	exception	critical	database, migration, user, unique-constraint, oidc
dropping routes table: %w	exception	critical	database, migration, sqlite, ddl, locking
checking if table %s exists: %w	exception	critical	database, sqlite, migration, corruption, startup
renaming table %s to %s_old: %w	exception	critical	database, sqlite, migration, ddl, locking
creating new table: %w	exception	critical	database, sqlite, migration, ddl, backup
copying data: %w	exception	critical	database, sqlite, migration, unique-constraint, data-migration
creating index: %w	exception	critical	database, sqlite, migration, index, unique-constraint
adding prefix column: %w	exception	critical	database, migration, gorm, sqlite, postgres, startup
adding hash column: %w	exception	critical	database, migration, gorm, bcrypt, startup
creating prefix index: %w	exception	critical	database, migration, unique-index, gorm, preauthkey
dropping index: %w	exception	critical	database, migration, index, postgres, locking
renaming forced_tags to tags: %w	exception	critical	database, migration, rename, gorm, schema-drift
loading users for RequestTags migration: %w	exception	critical	database, migration, users, policy, schema-drift
loading nodes for RequestTags migration: %w	exception	critical	database, migration, nodes, policy, memory
serializing merged tags for node %d: %w	exception	error	database, migration, json, memory, unreachable-path
updating tags for node %d: %w	exception	critical	database, migration, nodes, tags, locking
clearing user_id on tagged nodes: %w	exception	critical	database, migration, tags, nullable, bulk-update
clearing zero-time node expiry: %w	exception	critical	database, migration, expiry, nullable, data-normalization
recovering user_id on untagged nodes: %w	exception	critical	database, migration, data-repair, foreign-key, tags
adding user_id to api_keys: %w	exception	critical	database, migration, api-keys, gorm, ddl
adding description to pre_auth_keys: %w	exception	critical	database, migration, preauthkey, gorm, ddl
adding revoked to pre_auth_keys: %w	exception	critical	database, migration, preauthkey, soft-delete, ddl
creating oauth_clients table: %w	exception	critical	database, migration, oauth, ddl, create-table
creating oauth_clients index: %w	exception	critical	database, migration, oauth, unique-index, postgres
creating oauth_access_tokens table: %w	exception	critical	database, migration, oauth, ddl, create-table
creating oauth_access_tokens index: %w	exception	critical	database, migration, oauth, unique-index, transaction-aborted
clearing expiry on tagged nodes: %w	exception	critical	database, migration, sqlite, postgres, startup
migration failed: %w	exception	critical	database, migration, startup, gorm
storing database version: %w	exception	error	database, migration, metadata, permissions
getting DB from gorm: %w	exception	error	database, gorm, sqlite, connection
validating schema: %w	exception	critical	database, sqlite, schema-validation, squibble
creating directory for sqlite: %w	exception	error	database, sqlite, filesystem, permissions, config
building sqlite connection URL: %w	exception	error	database, sqlite, config, dsn
database of type %s is not supported: %w	console	error	database, config, validation
disabling foreign keys: %w	console	error	database, sqlite, pragma, locking, startup
running migration 202501311657: %w	console	critical	database, sqlite, migration, foreign-keys
restoring foreign keys: %w	console	error	database, sqlite, pragma, locking
reading IPv4 addresses from database: %w	exception	error	database, ip-allocation, ipv4, startup
reading IPv6 addresses from database: %w	exception	error	database, ip-allocation, ipv6, startup
parsing IP address from database: %w	exception	error	database, ip-allocation, data-corruption, parsing
building initial IP Set: %w	exception	error	config, ip-allocation, cidr, netipx
allocating IPv4 address: %w	exception	error	ip-allocation, ipv4, capacity, config
allocating IPv6 address: %w	exception	error	ip-allocation, ipv6, capacity, config
getting random IP: %w	exception	error	ip-allocation, random, entropy, crypto-rand
generating random IP: %w	exception	error	crypto-rand, entropy, sandbox, ip-allocation
%w: ip(%s) not in prefix(%s)	exception	warning	ip-allocation, invariant, cidr, defensive-check
backfilling IPs: %w	exception	error	go, database, ip-allocation, configuration, nil-guard
listing nodes to backfill IPs: %w	exception	error	go, database, sqlite, postgresql, transaction
allocating IPv4 for node(%d): %w	exception	error	go, database, ip-allocation, capacity, configuration
allocating IPv6 for node(%d): %w	exception	error	go, database, ip-allocation, ipv6, capacity
saving node(%d) after adding IPs: %w	exception	error	go, database, gorm, transaction, ip-allocation
renaming node: %w	validation	error	go, database, dns, validation, naming
checking name uniqueness: %w	exception	error	go, database, gorm, sqlite, concurrency
renaming node in database: %w	exception	error	go, database, gorm, race-condition, naming
registering existing node in database: %w	exception	error	go, database, registration, gorm, concurrency
saving node to database: %w	exception	error	go, database, registration, gorm, constraints
`ErrOAuthClientNotFound` oauth client not found: %w	error_code	error	go, oauth, authentication, sentinel-error, not-found
`ErrAccessTokenNotFound` oauth access token not found: %w	error_code	error	go, oauth, access-token, authentication, sentinel-error
generating salt: %w	exception	critical	go, crypto, argon2, entropy, oauth
saving oauth client: %w	exception	error	go, oauth, database, gorm, constraints
invalid oauth client secret: %w	validation	error	go, oauth, authentication, argon2, credentials
deleting oauth access tokens: %w	exception	error	go, oauth, database, revocation, gorm
saving oauth access token: %w	exception	error	go, oauth, access-token, race-condition, database
invalid oauth access token: %w	validation	error	go, oauth, access-token, authentication, argon2
`ErrPreAuthKeyNotFound` auth-key not found: %w	error_code	error	go, preauth-key, authentication, sentinel-error, not-found
`ErrPreAuthKeyACLTagInvalid` %w: '%s' did not begin with 'tag:'	validation	error	go, preauth-key, acl, validation, tags
creating key in database: %w	exception	error	database, gorm, preauth-key, sqlite, postgres
invalid auth key: %w	validation	error	preauth-key, authentication, bcrypt
%w: key too short, expected at least %d chars after prefix,	validation	error	preauth-key, validation, key-format
%w: expected separator '-' at position %d, got '%c'	validation	error	preauth-key, validation, key-format
%w: secret length mismatch, expected %d chars, got %d	validation	error	preauth-key, validation, key-format
%w: prefix contains invalid characters (expected base64 URL-	validation	error	preauth-key, validation, key-format, encoding
%w: secret contains invalid characters (expected base64 URL-	validation	error	preauth-key, validation, key-format, shell-quoting
%w, got %d	validation	error	sqlite, config, validation
%w: %s	validation	error	sqlite, config, validation, pragma
invalid config: %w	validation	error	sqlite, config, validation, connection-string
headscale version %s cannot be used with a database last use	console	critical	versioning, database, migration, startup
headscale version %s cannot be used with a database last use	console	critical	versioning, database, migration, upgrade, startup
headscale version %s cannot be used with a database last use	console	critical	versioning, database, migration, downgrade, startup
%w: %s	validation	error	dns, config, filesystem, validation
reading path: %s, err: %w	console	error	dns, filesystem, config-reload, fsnotify
unmarshalling records, content: %q: %w	console	error	dns, json, config, validation
invalid capability version	http	warning	http, validation, capability-version, headscale
request body too large	http	warning	derp, http, body-limit, dos-protection
Bad Request: invalid JSON	http	warning	derp, json, http, validation
invalid auth id	http	warning	auth, http, url-parameter, registration
upgrading noise connection: %w	http	error	noise, handshake, network, ts2021
`ErrUnsupportedClientVersion` unsupported client version: %s (%d)	http	warning	version-compat, noise, capability-version, upgrade
`ErrMissingURLParameter` missing URL parameter: %s	validation	warning	noise, routing, url-parameter, validation
parsing %s: %w	validation	warning	noise, node-id, validation, parsing
`ErrSSHDstNodeNotFound` dst node not found	http	warning	ssh, node-id, not-found, check-mode
`ErrSSHMachineKeyMismatch` machine key does not match dst node	http	error	ssh, security, authentication, machine-key
Internal error	http	error	ssh, config, url, internal-error
Invalid auth_id	http	warning	ssh, auth, url-parameter, validation
`ErrNoAuthSession` Invalid auth_id	http	warning	ssh, auth-cache, session-expiry, retry
`ErrSSHAuthSessionNotBound` auth session is not for SSH check	http	warning	ssh, auth, session-binding, validation
`ErrSSHBindingMismatch` src/dst pair does not match auth session	http	error	ssh, security, binding-mismatch, authorization
creating OIDC provider from issuer config: %w	console	critical	oidc, sso, config, network, startup
`errInvalidPKCEMethod` internal server error	http	error	oidc, pkce, config, validation
decoding ID token claims: %w	http	error
invalid code	http	error
failed to verify id_token	http	error
looking up user: %w	http	error
parsing policy: %w	validation	error
validating policy user references: %w	validation	error
collecting relay target IPs: %w	validation	error
resolving tag owners map: %w	validation	error
nodeAttrs target %s: %w	validation	error
parsing SSH policy, unknown action %q, index: %d: %w	validation	error
resolving auto approvers map: %w	validation	error
compiling SSH policy: %w	validation	error
tag %q %w %q	validation	error
compiling nodeAttrs: %w	validation	error
resolving: %w	validation	error
resolving destination %q: %w	validation	error
building IPSet for %q: %w	validation	error
%w:\n%s	validation	error
invalid alias: %w	validation	warning	policy, acl, testing, configuration, go
resolving: %w	validation	warning	policy, acl, testing, resolution, go
invalid destination %q: %w	validation	warning	policy, acl, testing, ports, configuration, go
resolving destination: %w	validation	warning	policy, acl, testing, resolution, hosts, go
%w: %q	validation	warning	policy, acl, testing, empty-result, go
%w, got: %q	validation	error	policy, acl, validation, username, configuration, go
%w: token %q	validation	error	policy, acl, user-lookup, configuration, go
%w: token %q found: %s	validation	error	policy, acl, user-lookup, data-integrity, go
%w: %q	validation	error	policy, acl, validation, hosts, configuration, go
%w: %s	validation	error	policy, acl, validation, ip-prefix, go
%w: got %q, must be one of %v	validation	error	policy, acl, validation, autogroups, configuration, go
dst=%q: port range %q: %w	validation	error	policy, acl, ports, validation, testing, go
%w: %T	validation	error	policy, acl, json, type-error, configuration, go
port range %q: %w	validation	error	policy, acl, ports, protocols, validation, go
%w, got: %v(%d)	validation	error	policy, acl, protocols, ports, validation, go
%w: group %q expected string but got %T	validation	error	policy, groups, json, type-error
%w: group %q got string: %q	validation	error	policy, groups, json, shape-error
%w: group %q got %T	validation	error	policy, groups, json, type-error
groups[%q]: %q: %w	validation	error	policy, groups, recursion
%w: hostname %q address %q	validation	error	policy, hosts, ip, validation
action=%q is not supported: %w	validation	error	policy, acl, action, validation
%q %w	validation	error	policy, ssh, action, validation
%w: %q must be a known protocol name or valid protocol numbe	validation	error	policy, protocol, validation
%w: %d	validation	error	policy, protocol, range, validation
%w: %q, can be %v	validation	error	policy, autogroup, acl, validation
%w: %q overlaps %q	validation	error	policy, nodeattrs, ippool, reserved-ranges, validation
%w (%s); use autogroup:tagged or specific tags as destinatio	validation	error	policy, ssh, tags, security-model, validation
%w %q; use autogroup:self instead for same-user SSH access	validation	error	policy, ssh, autogroup-self, validation
src=%w	validation	error	policy, acl, tags, tagowners, validation
dst=%q: %w	validation	error	policy, acl, tags, tagowners, validation
user %q %w	validation	error	policy, ssh, users, validation
%w %q	validation	error	policy, ssh, hosts, validation
dst %q: %w	validation	error	policy, grants, cidr, default-route, validation
tag %q not found	validation	error	policy, grants, via, tags, tagowners, validation
%w: %q (%T)	validation	error	policy, nodeattrs, groups, validation
%w: %q tracked in %s	validation	error
checkPeriod %s %w	validation	error
%w; use 'autogroup:member' for user-owned devices, 'autogrou	validation	error
%w: missing prefix %q in %q	validation	error
%w: missing @ in %q	validation	error
%w: local part must be *, got %q in %q	validation	error
%w: empty domain in %q	validation	error
parsing HuJSON: %w	validation	error
tagOwners[%q]: %w	validation	error
parsing policy from bytes: %w	validation	error
%w: %q, only "*" is allowed	validation	error
test %d: %w	validation	error
test %d: %w: %q	validation	error
test %d, accept %q: %w	validation	error
test %d, deny %q: %w	validation	error
%w: %w	validation	error
sshTest %d: %w	validation	error
%w: %q	validation	error
%w: %s	console	error
initializing database: %w	console	error
initializing IP allocator: %w	console	error
loading nodes: %w	console	error
loading users: %w	console	error
loading policy: %w	console	error
initializing policy manager: %w	console	error
setting policy: %w	http	error
auto approving nodes: %w	http	error
creating user: %w	http	error
updating policy manager after user creation: %w	http	error
updating user: %w	http	error
updating policy manager after user update: %w	http	error
updating policy after user deletion: %w	http	error
%w: %d	http	error
saving node: %w	http	error
updating policy manager after node save: %w	http	error
updating policy manager after node deletion: %w	http	error
setting node expiry in database: %w	http	error
updating policy manager after setting expiry: %w	http	error
%w %v are invalid or not permitted	validation	error
%w: %w	validation	error
%w: %s	validation	error
renaming node: %w	http	error	state, node-store, rename, go
refreshing NodeStore after IP backfill: %w	http	error	state, database, backfill, startup, go
allocating IPs: %w	exception	critical	ip-allocation, capacity, registration, config, go
using pre auth key: %w	exception	error	preauthkey, registration, database, go
finding user: %w	exception	error	oidc, users, database, registration, go
updating policy manager users: %w	exception	error	policy, users, oidc, registration, go
updating policy manager nodes: %w	exception	error	policy, nodes, registration, go
`errOIDCIssuerInvalid` oidc.issuer must be a valid http(s) URL: got %q	validation	error	config, oidc, validation, startup, go
fatal error reading config file: %w	console	critical	config, yaml, startup, viper, go
unmarshalling dns extra records: %w	validation	error	config, dns, yaml, validation, go
parsing %s prefix from config: %w	validation	error	config, networking, cidr, validation, go
trusted_proxies[%d] %q: %w	validation	error	config, network, proxy, startup
`errTrustedProxyZeroRange` trusted_proxies[%d] %q: 0.0.0.0/0 and ::/0 are not allowed	validation	error	config, security, proxy, startup
`ErrInvalidAllocationStrategy` invalid prefix allocation strategy: %q, allowed options: %s, %s	validation	error	config, ip-allocation, startup
`ErrHostnameTooLong` creating valid FQDN (%s): %w	validation	error	dns, node, magicdns, validation
%q is not a valid DNS label: %w	validation	error	dns, validation, node, rename
username contains invalid character: '%c'	validation	error	username, dns, validation, oidc
creating directory failed with permission error: %s	console	error	filesystem, permissions, startup, container
creating directory %s: %w	console	error	filesystem, startup, io
creating certificates for derp test: %w	exception	error	integration-test, tls, docker, derp
%s starting tailscale DERPer container (version: %s): %w	exception	error	integration-test, docker, derp, infrastructure
writing TLS certificate to container: %w	exception	error	integration-test, docker, tls, derp
writing TLS key to container: %w	exception	error	integration-test, docker, tls, derp
DERPer is not ready: %w	exception	error	integration-test, derp, network, docker
executing command, stdout: %q stderr: %q, err: %w	exception	warning	integration-test, assertion, container, exec
executing command, expected string %q not found in %q	exception	warning	integration-test, assertion, eventual-consistency
listing users: %w	exception	error	integration-test, api, grpc, users
user %s not found	exception	error	integration-test, users, api
listing original clients: %w	exception	error	integration-test, scenario, docker, clients
creating tailscale node: %w	exception	error	integration-test, scenario, docker, clients
listing updated clients: %w	exception	error	integration-test, docker, retry, headscale-cli
expected %d clients, got %d	exception	error	integration-test, node-registration, retry, timing
finding new client: %w	exception	error	integration-test, diffing, concurrency
timeout waiting for new client: %w	exception	error	integration-test, timeout, retry, backoff
getting user: %w	exception	error	integration-test, user-management, grpc-api
creating preauth key: %w	exception	error	integration-test, preauth-key, grpc-api
logging in new client: %w	exception	error	integration-test, login, authkey, tailscale-client
creating default TLS certificates: %w	exception	error	integration-test, tls, certificate, x509
starting postgres container: %w	exception	error	integration-test, docker, postgres, dockertest
running pre-built headscale container %q: %w	exception	error	integration-test, docker, prebuilt-image, registry
starting headscale container: %w\n\nDocker build failed. Las	exception	error	integration-test, docker-build, diagnostics
starting headscale container: %w\n\nDocker build succeeded o	exception	error	integration-test, docker, container-runtime, ipv6
starting headscale container: %w\n\nUnable to get diagnostic	exception	error	integration-test, docker-build, diagnostics, docker-daemon
writing TLS certificate to container: %w	exception	error	integration-test, docker, ca-certificates, file-copy
writing headscale config to container: %w	exception	error	integration-test, docker, configuration, file-copy
writing policy: %w	exception	error	integration-test, acl-policy, hujson, docker
writing TLS key to container: %w	exception	error	integration-test, tls, docker, file-copy
writing %q: %w	exception	error	integration-test, docker, file-copy, test-options
loading database policy on startup: %w	exception	error	integration-test, policy, database, hujson
reading container logs: %w	exception	warning	docker, integration-test, logging, container
creating metrics request: %w	exception	error	metrics, http, integration-test, validation
creating or getting network: %w	exception	error	docker, network, integration-test
adding test suite container to network: %w	exception	error	docker, network, integration-test, test-runner
no network named: %s	exception	error	docker, network, integration-test, lookup
no IPAM config found in network: %s	exception	error	docker, network, ipam, integration-test
creating headscale container: %w	exception	critical	docker, headscale, integration-test, container
reaching headscale container: %w	exception	critical	docker, headscale, health-check, integration-test, startup
creating user: %w	exception	error	preauth-key, grpc, integration-test, headscale
creating preauth key with options: %w	exception	error	preauth-key, grpc, integration-test, validation
creating preauth key with tags: %w	exception	error	preauth-key, tags, headscale, integration-test
creating tailscale node (version: %s): %w	exception	error	tailscale, node, headscale, integration-test
creating tailscale node: %w	exception	error	tailscale, docker, container, integration-test
waiting for tailscaled (%s) to need login: %w	exception	error
adding tailscale node: %w	exception	error
%s bringing up tailscale node: %w	exception	error
bringing up tailscale node: %w	exception	error
pre-barrier: %w	exception	error
%s tailscale node has not reached running: %w	exception	error
%s creating cookiejar: %w	exception	error
%s http client is nil	exception	error
%s login url is nil	exception	error
%s creating http request: %w	exception	error
%s sending http request: %w	exception	error
%s reading response body: %w	exception	error
%s resolving redirect location: %w	exception	error
%s unexpected status code %d	exception	error
%s confirm form: no action attribute	exception	error
%s confirm form: unterminated action attribute	exception	error	html-parsing, integration, registration, headscale
%s confirm form: no CSRF input	exception	error	html-parsing, integration, csrf, registration
%s confirm form: no input tag for CSRF	exception	error	html-parsing, integration, csrf
%s confirm form: unterminated input tag	exception	error	html-parsing, integration, csrf
%s confirm form: no value in CSRF input	exception	error	html-parsing, integration, csrf
%s creating confirm request: %w	exception	error	http, integration, url-parsing
%s sending confirm request: %w	exception	error	http, network, integration, docker
%s reading confirm response: %w	exception	error	http, network, integration
%s confirm returned status %d: %s	exception	error	http, integration, registration, csrf
finding headscale: %w	exception	error	integration, lifecycle, headscale
getting IPs: %w	exception	error	integration, tailscale, readiness
getting clients: %w	exception	error	integration, validation, user-management
creating DERP server: %w	exception	error	docker, integration, derp, infrastructure
reaching DERP server: %w	exception	error	docker, integration, derp, readiness
network does not exist: %s	exception	error	docker, integration, networking, validation
%s failed to fetch tailscale status: %w	exception	error	tailscale, integration, readiness, docker
no network set, called from: %s	exception	error	docker, integration, tailscale, validation
running pre-built tailscale container %q: %w	exception	error	docker, integration, tailscale, image-management
%s could not start tailscale container (version: %s): %w Do	exception	critical	docker, integration, tailscale, build
%s could not start tailscale container (version: %s): %w Do	exception	error
%s could not start tailscale container (version: %s): %w Un	exception	error
%s could not start tailscale container (version: %s): %w	exception	error
writing TLS certificate to container: %w	exception	error
%s failed to join tailscale client (%s): %w	exception	error
logging out, stdout: %s, stderr: %s	exception	error
restarting container %s: %w	exception	error
container not ready: %w	exception	error
timeout waiting for container %s to restart and become ready	exception	error
%s failed to bring tailscale client up (%s): %w	exception	error
%s failed to bring tailscale client down (%s): %w	exception	error
%s failed to get IPs: %w	exception	error
parsing IP %s: %w	exception	error
no IPs returned yet for %s	exception	error
getting IPs for %s after retries: %w	exception	error
no IPv4 address found for %s	exception	error
%s: %w	exception	error
status netmap to /tmp/control: %w	exception	error
saving netmap to /tmp/control: %w	exception	error
debug access denied	http	error
bad form data	http	error
internal server error	http	error
unsupported client version: %s (%d)	http	error
Not implemented yet	http	error
method not allowed	http	error
missing ping ID	http	error
unknown or expired ping	http	error