edge-router.example.toml can't be run directly: ${...} expansion runs over comments #15

New issue

Closed

opened 2026-08-03 11:33:03 +00:00 by james.oates · 1 comment

james.oates commented

2026-08-03 11:33:03 +00:00

Owner

Background

Found during the Network Access Control feature work. Pre-existing, not introduced by that feature.

Problem

ROUTES_CONFIG=edge-router.example.toml cargo run fails at startup with Environment variable 'ER_VAR_NAME' is not set.

Root cause: expand_env_refs in src/routes_config.rs does raw-text ${...} substitution over the entire file content, including comments, before toml::from_str ever parses it. The example file's TLS-section documentation comments contain literal ${VAR_NAME} / ${CF_TOKEN} tokens (as illustrative syntax), so expansion tries to resolve them as real env vars and aborts.

Consequence: the shipped example file can't be run verbatim, only after a user copies and customizes it — which is the intended workflow, but the failure mode is a confusing hard error rather than anything pointing at "this is a template".

Proposed fix

Make ${...} expansion comment-aware (skip #-comment regions), or perform expansion after TOML parse on string values only rather than raw file text. Either keeps the documented ${...} syntax in comments intact while still expanding real values.

Severity

Minor — the example is a template meant to be copied first; no runtime/security impact on a real deployment. Filed so the example is runnable-as-shipped for anyone who tries it directly. (A one-paragraph networking note was already added to the example in commit b728117; this expansion issue is separate.)

## Background Found during the Network Access Control feature work. Pre-existing, not introduced by that feature. ## Problem `ROUTES_CONFIG=edge-router.example.toml cargo run` fails at startup with `Environment variable 'ER_VAR_NAME' is not set`. Root cause: `expand_env_refs` in `src/routes_config.rs` does raw-text `${...}` substitution over the **entire file content, including comments**, before `toml::from_str` ever parses it. The example file's TLS-section documentation comments contain literal `${VAR_NAME}` / `${CF_TOKEN}` tokens (as illustrative syntax), so expansion tries to resolve them as real env vars and aborts. Consequence: the shipped example file can't be run verbatim, only after a user copies and customizes it — which is the intended workflow, but the failure mode is a confusing hard error rather than anything pointing at "this is a template". ## Proposed fix Make `${...}` expansion comment-aware (skip `#`-comment regions), or perform expansion after TOML parse on string *values* only rather than raw file text. Either keeps the documented `${...}` syntax in comments intact while still expanding real values. ## Severity Minor — the example is a template meant to be copied first; no runtime/security impact on a real deployment. Filed so the example is runnable-as-shipped for anyone who tries it directly. (A one-paragraph networking note was already added to the example in commit `b728117`; this expansion issue is separate.)

james.oates referenced this issue

2026-08-03 13:11:17 +00:00

Composable per-listener access control (bindings, listeners, access rules) #3

james.oates commented

2026-10-05 17:59:36 +00:00

Author

Owner

Fixed on main by 346bcdf, using the second option proposed above — expansion now runs after the TOML parse, walking string values of the parsed document, so comments and keys are untouched by construction.

The comment-aware alternative was rejected for the reason that # is legal inside a value: dir = "/srv/a#b" would be mangled by any comment-stripping pass short of tokenising TOML, at which point you may as well parse it. There's a regression test for that case alongside the comment one, and shipped_example_config_parses now loads the real edge-router.example.toml so it can't drift back into being unloadable.

The example has its ${CF_TOKEN} documentation back as a result.

Housekeeping: I filed #31 for this in September without checking the existing issues, so that was a duplicate of this one. #31 carries the fix detail and is closed; closing this as the original.

Fixed on `main` by `346bcdf`, using the second option proposed above — expansion now runs after the TOML parse, walking string **values** of the parsed document, so comments and keys are untouched by construction. The comment-aware alternative was rejected for the reason that `#` is legal inside a value: `dir = "/srv/a#b"` would be mangled by any comment-stripping pass short of tokenising TOML, at which point you may as well parse it. There's a regression test for that case alongside the comment one, and `shipped_example_config_parses` now loads the real `edge-router.example.toml` so it can't drift back into being unloadable. The example has its `${CF_TOKEN}` documentation back as a result. Housekeeping: I filed #31 for this in September without checking the existing issues, so that was a duplicate of this one. #31 carries the fix detail and is closed; closing this as the original.

james.oates closed this issue

2026-10-05 17:59:42 +00:00

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

IsoHex/edge-router#15

No description provided.

Rows
Columns