juanfont/headscale · error

setting policy: %w

Error message

setting policy: %w

What it means

Error "setting policy: %w" thrown in juanfont/headscale.

Source

Thrown at hscontrol/state/state.go:335

	s.derpMap.Store(dm)
}

// DERPMap returns the current DERP relay configuration for peer-to-peer connectivity.
func (s *State) DERPMap() tailcfg.DERPMapView {
	return s.derpMap.Load().View()
}

// ReloadPolicy reloads the access control policy and triggers auto-approval if changed.
// Returns the resulting [change.Change] slice when the policy or routes changed.
func (s *State) ReloadPolicy() ([]change.Change, error) {
	pol, err := hsdb.PolicyBytes(s.db.DB, s.cfg)
	if err != nil {
		return nil, fmt.Errorf("loading policy: %w", err)
	}

	policyChanged, err := s.polMan.SetPolicy(pol)
	if err != nil {
		return nil, fmt.Errorf("setting policy: %w", err)
	}

	// Clear SSH check auth times when policy changes to ensure stale
	// approvals don't persist if checkPeriod rules are modified or removed.
	s.ClearSSHCheckAuth()

	// Rebuild peer maps after policy changes because the peersFunc in [NodeStore]
	// uses the [policy.PolicyManager]'s filters. Without this, nodes won't see
	// newly allowed peers until a node is added/removed, causing autogroup:self
	// policies to not propagate correctly when switching between policy types.
	s.nodeStore.RebuildPeerMaps()

	//nolint:prealloc // cs starts with one element and may grow
	cs := []change.Change{change.PolicyChange()}

	// Per-node selective self refresh for nodeAttrs. A broadcast
	// [change.PolicyChange] re-renders peer lists and packet filters
	// but never repopulates a node's own [tailcfg.Node.CapMap]; that

View on GitHub (pinned to 565fd254d0)

Solutions

1. Inspect the wrapped error for the underlying cause and correct the failing condition (setting policy); retry the operation after fixing the input, configuration, or environment.

Example fix

Inspect the wrapped error for the underlying cause and correct the failing condition (setting policy); retry the operation after fixing the input, configuration, or environment.

When it happens

Trigger: Thrown at hscontrol/state/state.go:335 when the library encounters an invalid state.

Common situations: Applying a new policy failed. Run 'headscale policy check' against the policy to find the invalid rule before setting it.

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/15697b9eef951bda. Report an issue: GitHub.