juanfont/headscale · error

auto approving nodes: %w

Error message

auto approving nodes: %w

What it means

Error "auto approving nodes: %w" thrown in juanfont/headscale.

Source

Thrown at hscontrol/state/state.go:369

	// Per-node selective self refresh for nodeAttrs. A broadcast
	// [change.PolicyChange] re-renders peer lists and packet filters
	// but never repopulates a node's own [tailcfg.Node.CapMap]; that
	// lives on the self entry only. The drain returns every node ID
	// whose cap output shifted across recent updateLocked calls —
	// refreshNodeAttrsLocked appends rather than overwrites so a
	// concurrent SetUsers/SetNodes between SetPolicy and the drain
	// cannot silently lose the policy-reload diff.
	for _, id := range s.polMan.NodesWithChangedCapMap() {
		cs = append(cs, change.SelfUpdate(id))
	}

	// Always call autoApproveNodes during policy reload, regardless of whether
	// the policy content has changed. This ensures that routes are re-evaluated
	// when they might have been manually disabled but could now be auto-approved
	// with the current policy.
	rcs, err := s.autoApproveNodes()
	if err != nil {
		return nil, fmt.Errorf("auto approving nodes: %w", err)
	}

	// TODO(kradalby): These changes can probably be safely ignored.
	// If the PolicyChange is happening, that will lead to a full update
	// meaning that we do not need to send individual route changes.
	cs = append(cs, rcs...)

	if len(rcs) > 0 || policyChanged {
		log.Info().
			Bool("policy.changed", policyChanged).
			Int("route.changes", len(rcs)).
			Int("total.changes", len(cs)).
			Msg("Policy reload completed with changes")
	}

	return cs, nil
}

View on GitHub (pinned to 565fd254d0)

Solutions

1. Inspect the wrapped error for the underlying cause and correct the failing condition (auto approving nodes); retry the operation after fixing the input, configuration, or environment.

Example fix

Inspect the wrapped error for the underlying cause and correct the failing condition (auto approving nodes); retry the operation after fixing the input, configuration, or environment.

When it happens

Trigger: Thrown at hscontrol/state/state.go:369 when the library encounters an invalid state.

Common situations: Auto-approving routes for nodes failed during a policy update. Check that autoApprovers entries resolve and advertised routes are valid.

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/b106ed0f933ce8c3. Report an issue: GitHub.