nextcloud/all-in-one · error · \Exception

Could not reach the deSEC API: {message}

Error message

Could not reach the deSEC API: {message}

What it means

Thrown by DesecManager::registerAccount when the Guzzle POST to {desecApiBase}/auth/ raises a TransferException, i.e. DNS resolution failure, connection refused/timeout, TLS error, or a transport-level problem. HTTP error statuses (4xx/5xx) from deSEC surface through a different code path, so this message specifically means the API could not be reached at all.

Source

Thrown at php/src/Desec/DesecManager.php:200

    /**
     * Requests creation of a new deSEC account.
     *
     * deSEC replies 202 Accepted and emails a verification link; no API token is
     * returned here and the account is unusable until the email is verified. For
     * privacy reasons deSEC also returns 202 when the email is already registered
     * (without sending a mail), so a 202 cannot be treated as proof of a new account.
     * The captcha field is omitted; deSEC requires it only at email-verification time,
     * which the user completes in the browser via the emailed link.
     *
     * @throws \Exception on network failure or an unexpected HTTP response
     */
    public function registerAccount(string $email, string $password): void {
        try {
            $res = $this->guzzleClient->post($this->configurationManager->desecApiBase . '/auth/', [
                'json' => ['email' => $email, 'password' => $password],
            ]);
        } catch (TransferException $e) {
            throw new \Exception('Could not reach the deSEC API: ' . $e->getMessage());
        }

        $code = $res->getStatusCode();

        if ($code !== 202) {
            throw new \Exception('Unexpected response from deSEC during account registration (HTTP ' . $code . '): ' . $res->getBody()->getContents());
        }
    }

    /**
     * Attempts to log in after the user was asked to verify a freshly created account.
     *
     * A login failure here has two common causes that we cannot tell apart, because
     * deSEC returns 202 both for a genuinely new account and for one whose email was
     * already registered (to prevent email enumeration):
     *   1. The account is new but its email has not been verified yet.
     *   2. The email already belonged to an existing deSEC account, so no new account
     *      (and no verification mail) was created and our generated password is wrong.

View on GitHub (pinned to 6b788eec5e)

Solutions

1. From the host/container verify reachability: `curl -v https://desec.io/api/v1/auth/` and check DNS/firewall for desec.io on port 443.
2. If a proxy is required, pass it via the mastercontainer environment and make sure the container trusts the proxy's CA certificate.
3. Retry after a transient outage; check https://status.desec.io for deSEC-side incidents.
4. If egress is permanently restricted, use a manual deSEC account and configure DNS without the built-in registration flow.

// Pre-flight reachability before driving the deSEC flow
$res = @$guzzleClient->request('GET', $configurationManager->desecApiBase);
if (!isset($res) || $res->getStatusCode() >= 500) {
    // defer registration until connectivity is confirmed
}

use GuzzleHttp\Exception\TransferException;

try {
    $desecManager->registerAccount($email, $password);
} catch (TransferException $e) {
    // network-level failure (DNS/firewall/TLS): safe to retry with backoff
} catch (\Exception $e) {
    // API-level or validation outcome: inspect message, do not blind-retry
}

When it happens

Trigger: registerAccount() runs while the mastercontainer has no working internet egress: desec.io DNS fails, outbound 443 blocked by firewall, proxy misconfigured (missing HTTP(S)_PROXY env), TLS interception with an untrusted CA, or IPv6-only broken connectivity.

Common situations: Homelab behind a restrictive firewall or Pi-hole blocklist blocking desec.io; corporate TLS-inspecting proxy whose CA is not in the container trust store; transient deSEC outage; container DNS misconfigured after Docker network changes.

Related errors

• DNS config is not set for this domain or the domain is not a
• A domain is already configured. Reset the AIO instance first
• Please provide a valid email address.
• The desired subdomain must contain only lowercase letters, d
• It seems like the ip-address of the domain is set to an inte

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/4afa24ca8a573338. Report an issue: GitHub.