vxcontrol/pentagi · error · Fatal

failed to create http client: %w

Error message

failed to create http client: %w

What it means

The SearxNG searcher builds its HTTP client via system.GetHTTPClient(s.cfg), which constructs a client honoring the app's TLS/proxy configuration. Failure here (wrapped as Fatal) means the secure client could not be initialized — typically a problem loading the CA certificate pool or TLS material from configuration, before any network call is attempted.

Source

Thrown at backend/pkg/tools/searchers/searxng.go:111

	params.Add("language", s.language())
	params.Add("categories", s.categories())
	params.Add("safesearch", s.safeSearch())

	if timeRange := s.timeRange(); timeRange != "" {
		params.Add("time_range", timeRange)
	}

	if maxResults > 0 {
		params.Add("limit", strconv.Itoa(maxResults))
	} else {
		params.Add("limit", "10")
	}

	apiURL.RawQuery = params.Encode()

	client, err := system.GetHTTPClient(s.cfg)
	if err != nil {
		return "", Fatal(fmt.Errorf("failed to create http client: %w", err))
	}

	client.Timeout = s.timeout()

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL.String(), nil)
	if err != nil {
		return "", Fatal(fmt.Errorf("failed to create request: %w", err))
	}

	req.Header.Set("User-Agent", "PentAGI/1.0")

	resp, err := client.Do(req)
	if err != nil {
		return "", Retryable(fmt.Errorf("failed to do request: %w", err), 0)
	}
	defer resp.Body.Close()

	return s.parseHTTPResponse(resp, query)

View on GitHub (pinned to ea665308ba)

Solutions

1. Check the TLS/CA configuration values passed via env (custom CA file path) and confirm the file exists and is readable inside the container
2. Look at system.GetHTTPClient to see which config fields it consumes and validate each
3. Fix file permissions (chmod 644) or correct the cert path in docker-compose.yml/.env
4. Remove the custom TLS override temporarily to confirm the default client works
5. This error is Fatal and non-retryable — it will recur on every search until config is fixed

// preflight: verify custom CA material is readable before constructing the client
if caPath := os.Getenv("CUSTOM_CA_PATH"); caPath != "" {
    if _, err := os.ReadFile(caPath); err != nil {
        log.Fatalf("CA cert unreadable: %v", err)
    }
}

When it happens

Trigger: Custom CA/TLS configuration in the app config pointing to a missing or unreadable certificate file; invalid proxy settings that the http.Transport builder rejects; corrupted cert pool initialization in system.GetHTTPClient.

Common situations: Mounting a custom CA cert path into the container but the file is absent or has wrong permissions; typo in the CA path env var; running with a restrictive read-only filesystem where cert files are not present.

Related errors

• failed to create http client: %w
• failed to create http client: %w
• failed to create http client: %w
• failed to create http client: %w
• invalid searxng base URL: %w

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/0fe7b11fb7afc3e4. Report an issue: GitHub.