slackhq/nebula · error

lighthouse %s does not have a static_host_map entry

Error message

lighthouse %s does not have a static_host_map entry

What it means

parseLighthouses validates that every configured lighthouse host appears in the static_host_map. A lighthouse must be reachable via a static address since you cannot use lighthouse discovery to find the lighthouses themselves.

Source

Thrown at lighthouse.go:407

		}

		if !lh.myVpnNetworksTable.Contains(addr) {
			lh.l.Warn("lighthouse host is not within our networks, lighthouse functionality will work but layer 3 network traffic to the lighthouse will not",
				"vpnAddr", addr,
				"networks", lh.myVpnNetworks,
			)
		}
		out[i] = addr
	}

	if !lh.amLighthouse && len(out) == 0 {
		lh.l.Warn("No lighthouse.hosts configured, this host will only be able to initiate tunnels with static_host_map entries")
	}

	staticList := lh.GetStaticHostList()
	for i := range out {
		if _, ok := staticList[out[i]]; !ok {
			return nil, fmt.Errorf("lighthouse %s does not have a static_host_map entry", out[i])
		}
	}

	return out, nil
}

func getStaticMapCadence(c *config.C) (time.Duration, error) {
	cadence := c.GetString("static_map.cadence", "30s")
	d, err := time.ParseDuration(cadence)
	if err != nil {
		return 0, err
	}
	return d, nil
}

func getStaticMapLookupTimeout(c *config.C) (time.Duration, error) {
	lookupTimeout := c.GetString("static_map.lookup_timeout", "250ms")
	d, err := time.ParseDuration(lookupTimeout)

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Add an entry for the lighthouse IP in static_host_map (lighthouse IP -> public-ip:port)
2. Remove the offending lighthouse from lighthouse.hosts
3. Fix YAML so hosts and static_host_map entries agree
4. Re-run/reload config after fixing

Example fix

// before (config.yml)
lighthouse:
  hosts: ["192.168.100.1"]
// static_host_map missing 192.168.100.1
// after
static_host_map:
  "192.168.100.1": ["203.0.113.10:4242"]
lighthouse:
  hosts: ["192.168.100.1"]

// before reload/startup
staticList := lh.GetStaticHostList()
for _, host := range cfg.Lighthouse.Hosts {
    if _, ok := staticList[host]; !ok {
        log.Printf("lighthouse %s missing from static_host_map", host)
    }
}

When it happens

Trigger: Running reload with lighthouse.hosts containing an IP that is absent from static_host_map (after staticList := lh.GetStaticHostList()).

Common situations: Adding a lighthouse to lighthouse.hosts but forgetting to add its public IP:port under static_host_map in config.yml; changing lighthouse IPs during migration; YAML indentation mistakes putting entries in the wrong section.

Related errors

• could not parse rule
• %s failed to parse, should be an array of rules
• %s rule #%v; %s
• ErrInvalidLocalIP
• ErrNoCredential

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/a8c2ca4ae2e67eaa. Report an issue: GitHub.