netbirdio/netbird · error

get setup key: %v

Error message

get setup key: %v

What it means

Raised inside doDaemonUp when reading the setup key fails. getSetupKey prefers --setup-key; when that is empty and --setup-key-file is set, it reads the file and trims whitespace. The error here wraps a file read failure (the inner message is 'failed to read setup key file: ...'), e.g. missing file or permission denied.

Source

Thrown at client/cmd/up.go:343

		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unavailable {
			log.Warnf("setConfig method is not available in the daemon: %s", st.Message())
		} else {
			return daemonCallError("call service setConfig method", err)
		}
	}

	if err := doDaemonUp(ctx, cmd, client, pm, activeProf, customDNSAddressConverted, username.Username); err != nil {
		return fmt.Errorf("daemon up failed: %v", err)
	}
	cmd.Println("Connected")
	return nil
}

func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServiceClient, pm *profilemanager.ProfileManager, activeProf *profilemanager.Profile, customDNSAddressConverted []byte, username string) error {

	providedSetupKey, err := getSetupKey()
	if err != nil {
		return fmt.Errorf("get setup key: %v", err)
	}

	loginRequest, err := setupLoginRequest(providedSetupKey, customDNSAddressConverted, cmd)
	if err != nil {
		return fmt.Errorf("setup login request: %v", err)
	}

	profileID := activeProf.ID.String()
	loginRequest.ProfileName = &profileID
	loginRequest.Username = &username

	profileState, err := pm.GetProfileState(activeProf.ID)
	if err != nil {
		log.Debugf("failed to get profile state for login hint: %v", err)
	} else if profileState.Email != "" {
		loginRequest.Hint = &profileState.Email
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify the file exists and is readable: `ls -l <path>` and `cat <path>` as the same user
2. Fix the path, or pass the key directly with --setup-key (the flags are mutually exclusive)
3. For containers, confirm the secret/volume is mounted at the path passed to the flag

Example fix

# before
netbird up --setup-key-file /etc/netbird/setup-key
# after
netbird up --setup-key-file /run/secrets/netbird-setup-key  # correct mount point

// before running up, check the file the flag will point at
if setupKeyFile != "" {
	info, err := os.Stat(setupKeyFile)
	if err != nil || info.IsDir() {
		return fmt.Errorf("setup key file unusable: %v", err)
	}
}

When it happens

Trigger: `netbird up --setup-key-file /path/key` where the path does not exist, is a directory, or is unreadable by the invoking user. Not triggered when --setup-key is also given (that flag wins) or neither flag is set.

Common situations: Secrets injected at a path that changed (e.g. Docker secret mounted elsewhere), typo in the path, file owned by root but CLI run as a normal user, or a systemd unit with a wrong WorkingDirectory-relative path.

Related errors

• failed to create artifact key: %w
• read root private key file: %w
• write private key file (%s): %w
• write public key file (%s): %w
• write signature file (%s): %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/988c045bd6e837d3. Report an issue: GitHub.