-
-
Notifications
You must be signed in to change notification settings - Fork 0
Troubleshooting
Common errors and what they mean. If your issue isn't here, open one on the repository with the relevant assess --json output (scrubbed).
CLOUDFLARE_API_TOKEN isn't set, or lacks read access to the zone. Use a read-only token that can see the zone (and, for zones, the account). flareover never needs write access to the source.
That's by design — it's a CI gate:
-
0= everything AUTO -
11= there are ASK items to answer -
10= there are MANUAL items to handle
Answer the ASKs with resolve; handle the MANUALs by hand. A non-zero exit is information, not failure.
Check its rationale in assess — flareover names why. Common cases: a compound firewall expression (and/or), a Worker, a country/ASN allowlist (only IP allowlists map), Automatic HTTPS Rewrites, or a lifecycle transition. These have no faithful deterministic mapping and are surfaced rather than guessed. See the Coverage Matrix.
Make sure --decisions decisions.lock points at the file you actually answered, and that the answer key matches. Re-run resolve to regenerate the lock. Unanswered questions are intentionally not generated.
The generated Caddyfile or zone didn't parse. This usually means caddy isn't on PATH (validation shells out to it) — install the Caddy binary, or drop --validate to skip the parse check. If Caddy is installed and it still fails, that's a bug worth reporting with the generated out/caddy/Caddyfile.
Secrets are read from the environment only. Set PDNS_API_KEY / CERTMATE_TOKEN and drop the --pdns-key / --certmate-token flags:
export PDNS_API_KEY=… CERTMATE_TOKEN=…Typo in the DNS target. Valid values: powerdns | scaleway | ovh | gandi | leaseweb | hetzner | route53 | clouddns | azure for provision (plus bunny for prepare, which is preview-only). See DNS Targets.
Each managed backend reads its credentials from the environment — the error names the exact variable(s). See the Security table.
flareover manages records, not zones. Create the zone with your DNS provider first, then re-run provision — it never auto-creates the zone.
bunny.net is preview-only: prepare --dns bunny emits a records file plus an apply.sh that uses the bunny.net CLI. Run that script to apply; there's no native provision path for bunny.
That's intentional — these are US-operated and not sovereign. The note nudges you toward the EU-owned options. It doesn't stop provisioning.
Aruba's S3 endpoint is account-specific (the Service Point URL from your account page). flareover won't guess it — pass it explicitly:
flareover storage buckets.json --dest aruba --minio-endpoint https://<your-service-point> --out ./outOnly EU regions are accepted, to keep the migration EU-scoped. The error lists the valid regions for that provider.
If it only tiers objects (a transition) or has no positive expiry (e.g. multipart-abort / noncurrent-version only), it's MANUAL — MinIO has no equivalent to emit. Only expiry rules with > 0 days map.
A HARD parity divergence between the live and staged edge (status code, redirect, header, or body). Fix the difference before cutting over — that's the gate doing its job. SOFT divergences are surfaced but don't block.
The cutover was blocked (a gate didn't pass). Re-run present to see the specific divergence.
flareover versionSee Installation — verify the cosign-signed checksums.txt, then sha256sum -c.
flareover — deterministic migration off the orange cloud to EU-sovereign, self-hosted infrastructure · 📖 Docs · Repository · Releases · AGPL-3.0-only · © Fabrizio Salmi
Start here
Concepts
Reference
Help