sigoden/dufs · error · anyhow::Error

No tls-key set

Error message

No tls-key set

What it means

dufs's CLI parser (Args::parse in src/args.rs) validates TLS options when the 'tls' feature is compiled in. If you pass --tls-cert but no matching --tls-key, it bails with 'No tls-key set' because a certificate alone cannot terminate TLS — both halves of the keypair are required.

Solutions

1. Add --tls-key pointing to the PEM private key file
2. Use --tls-cert with both --tls-cert and --tls-key as a pair
3. If you don't need HTTPS, remove --tls-cert entirely instead

Example fix

# before
dufs ./assets --tls-cert cert.pem
# after
dufs ./assets --tls-cert cert.pem --tls-key key.pem

# shell pre-check
if [ -n "$TLS_CERT" ] && [ -z "$TLS_KEY" ]; then echo "--tls-key is required with --tls-cert"; exit 1; fi

When it happens

Trigger: Running dufs with --tls-cert <path> but omitting --tls-key <path>. The match on (tls_cert, tls_key) hits the (Some(_), _) arm and bails before the server starts.

Common situations: Copy-pasted a TLS example and dropped the key flag; assumed the key is inferred from the cert file; scripted startup where only the cert path was templated in.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• No tls-cert set
• Path ` ` doesn't contains index.html
• Invalid auth, no duplicate anonymous rules
• Invalid auth
• Path ` ` doesn't exist

AI-assisted analysis of sigoden/dufs@fe7fd564f8 (2026-09-09). Data as JSON: /api/errors/bcf3f322de34caa4. Report an issue: GitHub.

Appendix: source

Thrown at src/args.rs:445

        }

        if let Some(compress) = matches.get_one::<Compress>("compress") {
            args.compress = *compress;
        }

        #[cfg(feature = "tls")]
        {
            if let Some(tls_cert) = matches.get_one::<PathBuf>("tls-cert") {
                args.tls_cert = Some(tls_cert.clone())
            }

            if let Some(tls_key) = matches.get_one::<PathBuf>("tls-key") {
                args.tls_key = Some(tls_key.clone())
            }

            match (&args.tls_cert, &args.tls_key) {
                (Some(_), Some(_)) => {}
                (Some(_), _) => bail!("No tls-key set"),
                (_, Some(_)) => bail!("No tls-cert set"),
                (None, None) => {}
            }
        }
        #[cfg(not(feature = "tls"))]
        {
            args.tls_cert = None;
            args.tls_key = None;
        }

        Ok(args)
    }

    fn sanitize_path<P: AsRef<Path>>(path: P) -> Result<PathBuf> {
        let path = path.as_ref();
        if !path.exists() {
            bail!("Path `{}` doesn't exist", path.display());
        }

View on GitHub (pinned to fe7fd564f8)