onetimesecret/onetimesecret · error · RuntimeError

site.secret not set or empty

Error message

site.secret not set or empty

What it means

Error "site.secret not set or empty" thrown in onetimesecret/onetimesecret.

Source

Thrown at lib/onetime/initializers/configure_familia.rb:81

        previous.each do |prev|
          keys[content_tag(prev)] = Onetime::KeyDerivation.derive_base64(prev, :familia_enc)
        end

        current_tag       = content_tag(secret_key)
        keys[current_tag] = Onetime::KeyDerivation.derive_base64(secret_key, :familia_enc)
        [keys, current_tag]
      end

      # Content-addressed envelope version tag for a secret: :"r<first-8-hex>"
      # of its :key_verifier derivation (same purpose the boot verifier uses,
      # so tag and stored verifier stay derivable from one another).
      def self.content_tag(secret)
        :"r#{Onetime::KeyDerivation.derive_hex(secret, :key_verifier)[0, 8]}"
      end

      def execute(_context)
        secret_key = OT.conf.dig('site', 'secret')
        raise 'site.secret not set or empty' if secret_key.to_s.empty?

        uri = OT.conf.dig('redis', 'uri') || ''

        # Strip surrounding quotes that may have been introduced via ENV var
        # misconfiguration (e.g., REDIS_URL="redis://..." instead of REDIS_URL=redis://...)
        # This prevents URI::InvalidURIError: bad URI (is not URI?)
        uri = uri.to_s.strip.gsub(/\A["']|["']\z/, '')

        # Early validation: Check if Redis URI is properly configured
        raise_error = if uri.empty?
          OT.boot_logger.fatal '[configure_familia] Invalid URI'
        elsif uri.include?('CHANGEME')
          OT.boot_logger.warn "[configure_familia] WARNING: Redis password is 'CHANGEME'"
        end

        raise Onetime::Problem, "Redis URI not configured (#{uri})" if raise_error

        # Test environment safety: Ensure tests use port 2163

View on GitHub (pinned to f81295e41b)

Solutions

1. Set site.secret in the configuration (or the matching environment variable) before starting the app.

When it happens

Trigger: Thrown at lib/onetime/initializers/configure_familia.rb:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of onetimesecret/onetimesecret@f81295e41b (2026-08-23). Data as JSON: /api/errors/b19a6911d2bc0bc8. Report an issue: GitHub.