use --nsqd-http-address or --lookupd-http-address not both

Error message

use --nsqd-http-address or --lookupd-http-address not both

What it means

nsqadmin supports exactly one discovery mode: either a static list of nsqd HTTP addresses (direct mode) or nsqlookupd addresses (cluster discovery). Supplying both is rejected because the two modes imply different topology semantics and merging them would double-report nodes and topics.

Source

Thrown at nsqadmin/nsqadmin.go:49

	httpClientTLSConfig *tls.Config
}

func New(opts *Options) (*NSQAdmin, error) {
	if opts.Logger == nil {
		opts.Logger = log.New(os.Stderr, opts.LogPrefix, log.Ldate|log.Ltime|log.Lmicroseconds)
	}

	n := &NSQAdmin{
		notifications: make(chan *AdminAction),
	}
	n.swapOpts(opts)

	if len(opts.NSQDHTTPAddresses) == 0 && len(opts.NSQLookupdHTTPAddresses) == 0 {
		return nil, errors.New("--nsqd-http-address or --lookupd-http-address required")
	}

	if len(opts.NSQDHTTPAddresses) != 0 && len(opts.NSQLookupdHTTPAddresses) != 0 {
		return nil, errors.New("use --nsqd-http-address or --lookupd-http-address not both")
	}

	if opts.HTTPClientTLSCert != "" && opts.HTTPClientTLSKey == "" {
		return nil, errors.New("--http-client-tls-key must be specified with --http-client-tls-cert")
	}

	if opts.HTTPClientTLSKey != "" && opts.HTTPClientTLSCert == "" {
		return nil, errors.New("--http-client-tls-cert must be specified with --http-client-tls-key")
	}

	n.httpClientTLSConfig = &tls.Config{
		InsecureSkipVerify: opts.HTTPClientTLSInsecureSkipVerify,
	}
	if opts.HTTPClientTLSCert != "" && opts.HTTPClientTLSKey != "" {
		cert, err := tls.LoadX509KeyPair(opts.HTTPClientTLSCert, opts.HTTPClientTLSKey)
		if err != nil {
			return nil, fmt.Errorf("failed to LoadX509KeyPair %s, %s - %s",
				opts.HTTPClientTLSCert, opts.HTTPClientTLSKey, err)

View on GitHub (pinned to 85cf10c09c)

Solutions

In a cluster with nsqlookupd, remove all --nsqd-http-address flags and keep --lookupd-http-address.
For a single nsqd without lookupd, remove all --lookupd-http-address flags.
Search the full command line AND config file: one leftover flag of the other kind is enough to fail.

Example fix

# before
nsqadmin --nsqd-http-address=10.0.0.1:4151 --lookupd-http-address=10.0.0.2:4161
# after
nsqadmin --lookupd-http-address=10.0.0.2:4161

Defensive patterns

Strategy: validation

Validate before calling

if len(opts.NSQDHTTPAddresses) > 0 && len(opts.NSQLookupdHTTPAddresses) > 0 {
	return nil, errors.New("nsqadmin: configure exactly one of nsqd or lookupd HTTP addresses")
}

Prevention

Encode the chosen mode once in a base systemd unit / helm values and forbid overriding with the other flag.
Lint rendered configs for the presence of both flag families in CI.

When it happens

Trigger: Running nsqadmin with both --nsqd-http-address and --lookupd-http-address present (either flag may be repeated; a single instance of each is enough to trigger). The check is len(opts.NSQDHTTPAddresses) != 0 && len(opts.NSQLookupdHTTPAddresses) != 0.

Common situations: Incrementally adding lookupd to an existing deployment and leaving the old --nsqd-http-address flag in systemd unit files; copy-pasted command lines from different runbooks; config templates that define both keys by default.

Related errors

AI-assisted analysis of nsqio/nsq@85cf10c09c (2026-08-16). Data as JSON: /api/errors/763164cf0e0c39f5. Report an issue: GitHub.