config `%s.interfaces` values must all be the same true/fals

Error message

config `%s.interfaces` values must all be the same true/false value

What it means

All values in an `interfaces` block must agree: either every interface is allowed (true) or every one is denied (false). Mixing true and false without a way to express a default is rejected, since name rules alone cannot resolve a fallback decision.

Source

Thrown at allow_list.go:202

			return nil, fmt.Errorf("config `%s.interfaces` has invalid value (type %T): %v", k, rawAllow, rawAllow)
		}

		nameRE, err := regexp.Compile("^" + name + "$")
		if err != nil {
			return nil, fmt.Errorf("config `%s.interfaces` has invalid key: %s: %v", k, name, err)
		}

		nameRules = append(nameRules, AllowListNameRule{
			Name:  nameRE,
			Allow: allow,
		})

		if firstEntry {
			allValues = allow
			firstEntry = false
		} else {
			if allow != allValues {
				return nil, fmt.Errorf("config `%s.interfaces` values must all be the same true/false value", k)
			}
		}
	}

	return nameRules, nil
}

func getRemoteAllowRanges(c *config.C, k string) (*bart.Table[*AllowList], error) {
	value := c.Get(k)
	if value == nil {
		return nil, nil
	}

	remoteAllowRanges := new(bart.Table[*AllowList])

	rawMap, ok := value.(map[string]any)
	if !ok {
		return nil, fmt.Errorf("config `%s` has invalid type: %T", k, value)

View on GitHub (pinned to dd8f660c0a)

Solutions

Make all interface values the same boolean
If you need both allow and deny semantics, split into multiple allow lists or use CIDR rules with an explicit 0.0.0.0/0 / ::/0 default

Example fix

// before
interfaces:
  eth0: true
  eth1: false
// after
interfaces:
  eth0: true
  eth1: true

Defensive patterns

Strategy: validation

Validate before calling

func interfaceValuesConsistent(m map[string]any) bool {
	var first bool
	i := 0
	for _, v := range m {
		b, ok := v.(bool)
		if !ok {
			return false
		}
		if i == 0 {
			first = b
		} else if b != first {
			return false
		}
		i++
	}
	return true
}

Prevention

Use a single boolean value across all interface entries
Express opposite semantics in a separate allow list

When it happens

Trigger: getAllowListInterfaces where entries include both eth0: true and eth1: false in the same interfaces map.

Common situations: Admins trying to express allowlist AND blocklist semantics in one interfaces block; the schema only supports a single-direction list.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/13259976e1c94c67. Report an issue: GitHub.