juanfont/headscale · error · ErrAutogroupNotSupportedACLSrc

%w: %q, can be %v

Error message

%w: %q, can be %v

What it means

validateAutogroupForSrc restricts which autogroups may appear in ACL src lists (ErrAutogroupNotSupportedACLSrc). autogroup:internet and autogroup:self are given dedicated errors; any other autogroup outside the autogroupForSrc allow-list is rejected here with the allowed values printed.

Source

Thrown at hscontrol/policy/v2/types.go:2046

	return nil
}

func validateAutogroupForSrc(src *AutoGroup) error {
	if src == nil {
		return nil
	}

	if src.Is(AutoGroupInternet) {
		return ErrAutogroupInternetSrc
	}

	if src.Is(AutoGroupSelf) {
		return ErrAutogroupSelfSrc
	}

	if !slices.Contains(autogroupForSrc, *src) {
		return fmt.Errorf("%w: %q, can be %v", ErrAutogroupNotSupportedACLSrc, *src, autogroupForSrc)
	}

	return nil
}

func validateAutogroupForDst(dst *AutoGroup) error {
	if dst == nil {
		return nil
	}

	if dst.Is(AutoGroupDangerAll) {
		return ErrAutogroupDangerAllDst
	}

	if !slices.Contains(autogroupForDst, *dst) {
		return fmt.Errorf("%w: %q, can be %v", ErrAutogroupNotSupportedACLDst, *dst, autogroupForDst)
	}

View on GitHub (pinned to 565fd254d0)

Solutions

1. Move the autogroup to dst if it is destination-only, per the allowed list in the error message
2. Replace it in src with explicit users/groups/tags
3. Use autogroup:member (if allowed by your version) instead of identity autogroups

Example fix

// before
{"src": ["autogroup:danger-all"], "dst": [...]}
// after
{"src": ["group:admins"], "dst": [...]}

var autogroupForSrc = map[string]bool{"autogroup:member": true /* per headscale docs */}

func validSrcAutogroup(s string) bool {
	if !strings.HasPrefix(s, "autogroup:") { return true }
	return autogroupForSrc[s]
}

When it happens

Trigger: Placing e.g. autogroup:danger-all or autogroup:member in an ACL rule's src list — only the values shown in the message are permitted as sources.

Common situations: Assuming membership autogroups (member, admin) can be traffic sources; porting policies between headscale versions whose allow-lists differ.

Related errors

• nodeAttrs target does not support this autogroup
• invalid autogroup
• autogroup:internet can only be used in ACL destinations
• "autogroup:self" not valid on the src side of a rule
• autogroup not supported for ACL sources

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/f905c1a28231d4e6. Report an issue: GitHub.