slackhq/nebula · error

config `%s.interfaces` is invalid (type %T): %v

Error message

config `%s.interfaces` is invalid (type %T): %v

What it means

getAllowListInterfaces parses the `interfaces` sub-block of an allow list, which must be a map of interface name patterns to booleans. If the value is not a map[string]any (e.g. a string, list, or bool), the config is rejected with the offending type shown in %T.

Source

Thrown at allow_list.go:176

	}

	if !rules6.defaultSet {
		if rules6.allValuesMatch {
			tree.Insert(netip.PrefixFrom(netip.IPv6Unspecified(), 0), !rules6.allValues)
		} else {
			return nil, fmt.Errorf("config `%s` contains both true and false rules, but no default set for ::/0", k)
		}
	}

	return &AllowList{cidrTree: tree}, nil
}

func getAllowListInterfaces(k string, v any) ([]AllowListNameRule, error) {
	var nameRules []AllowListNameRule

	rawRules, ok := v.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("config `%s.interfaces` is invalid (type %T): %v", k, v, v)
	}

	firstEntry := true
	var allValues bool
	for name, rawAllow := range rawRules {
		allow, ok := config.AsBool(rawAllow)
		if !ok {
			return nil, fmt.Errorf("config `%s.interfaces` has invalid value (type %T): %v", k, rawAllow, rawAllow)
		}

		nameRE, err := regexp.Compile("^" + name + "$")
		if err != nil {
			return nil, fmt.Errorf("config `%s.interfaces` has invalid key: %s: %v", k, name, err)
		}

		nameRules = append(nameRules, AllowListNameRule{
			Name:  nameRE,
			Allow: allow,

View on GitHub (pinned to dd8f660c0a)

Solutions

  1. Make `interfaces` a mapping like { eth0: true, "wg-.*": false }
  2. Remove surrounding quotes or list syntax around the interfaces block

Example fix

// before
allow_list:
  interfaces:
    - eth0
// after
allow_list:
  interfaces:
    eth0: true
Defensive patterns

Strategy: type-guard

Type guard

func isInterfacesMap(v any) bool {
	m, ok := v.(map[string]any)
	if !ok {
		return false
	}
	for _, val := range m {
		if _, ok := val.(bool); !ok {
			return false
		}
	}
	return true
}

Prevention

When it happens

Trigger: NewRemoteAllowListFromConfig / newAllowListFromConfig where the `interfaces` key holds a scalar or array instead of a mapping of names to true/false.

Common situations: Copy-paste mistakes nesting `interfaces` at the wrong level, or using YAML list syntax (- eth0) instead of a map.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/21e0c6684d159056. Report an issue: GitHub.