groups specified as %s, but host=any will match any host, re

Error message

groups specified as %s, but host=any will match any host, regardless of groups

What it means

host: any matches every host regardless of groups, so specifying groups together with host 'any' is contradictory — the groups can never restrict anything. The rule translator rejects the rule to prevent a false sense of scoping.

Source

Thrown at firewall.go:1032

func (r *rule) sanity() error {
	//port, proto, local_cidr are AND, no need to check here
	//ca_sha and ca_name don't have a wildcard value, no need to check here
	groupsEmpty := len(r.Groups) == 0
	hostEmpty := r.Host == ""
	cidrEmpty := r.Cidr == ""

	if (groupsEmpty && hostEmpty && cidrEmpty) == true {
		return nil //no content!
	}

	groupsHasAny := slices.Contains(r.Groups, "any")
	if groupsHasAny && len(r.Groups) > 1 {
		return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the other groups specified", r.Groups)
	}

	if r.Host == "any" {
		if !groupsEmpty {
			return fmt.Errorf("groups specified as %s, but host=any will match any host, regardless of groups", r.Groups)
		}

		if !cidrEmpty {
			return fmt.Errorf("cidr specified as %s, but host=any will match any host, regardless of cidr", r.Cidr)
		}
	}

	if groupsHasAny {
		if !hostEmpty && r.Host != "any" {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified host %s", r.Groups, r.Host)
		}
		if !cidrEmpty {
			return fmt.Errorf("groups spec [%s] contains the group '\"any\". This rule will ignore the specified cidr %s", r.Groups, r.Cidr)
		}
	}

	if r.Code != "" {
		return fmt.Errorf("code specified as [%s]. Support for 'code' will be dropped in a future release, as it has never been functional", r.Code)

View on GitHub (pinned to dd8f660c0a)

Solutions

Remove the groups field if you really want to match any host
Or replace host: any with the intended host name if you want groups to apply

Example fix

// before
host: any
groups: [prod]
// after
host: any

Defensive patterns

Strategy: validation

Validate before calling

func checkHostAnyRule(r FirewallRuleConfig) error {
    if r.Host == "any" && len(r.Groups) > 0 {
        return fmt.Errorf("host=any cannot be combined with groups")
    }
    return nil
}

Type guard

func isHostAnyConsistent(host string, groups []string) bool {
    return host != "any" || len(groups) == 0
}

Try / catch

if err := loadFirewallConfig(cfg); err != nil {
    if strings.Contains(err.Error(), "host=any will match any host") {
        return fmt.Errorf("redundant selectors with host=any: %w", err)
    }
    return err
}

Prevention

Remember host=any means the groups field must be empty
If you need group scoping, name the host explicitly instead of 'any'
Lint rules combining host: any with groups or cidr

When it happens

Trigger: A rule with host: any and a non-empty groups list during rule translation (e.g. host: any, groups: [prod]).

Common situations: Author thinking host=any means 'any host in these groups'; converting a host-specific rule to any and forgetting to drop groups.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/06a312f3563335ae. Report an issue: GitHub.