edge-router.example.toml can't be run directly: ${...} expansion runs over comments #15

New issue

Open

opened 2026-08-03 11:33:03 +00:00 by james.oates · 0 comments

james.oates commented

2026-08-03 11:33:03 +00:00

Owner

Background

Found during the Network Access Control feature work. Pre-existing, not introduced by that feature.

Problem

ROUTES_CONFIG=edge-router.example.toml cargo run fails at startup with Environment variable 'ER_VAR_NAME' is not set.

Root cause: expand_env_refs in src/routes_config.rs does raw-text ${...} substitution over the entire file content, including comments, before toml::from_str ever parses it. The example file's TLS-section documentation comments contain literal ${VAR_NAME} / ${CF_TOKEN} tokens (as illustrative syntax), so expansion tries to resolve them as real env vars and aborts.

Consequence: the shipped example file can't be run verbatim, only after a user copies and customizes it — which is the intended workflow, but the failure mode is a confusing hard error rather than anything pointing at "this is a template".

Proposed fix

Make ${...} expansion comment-aware (skip #-comment regions), or perform expansion after TOML parse on string values only rather than raw file text. Either keeps the documented ${...} syntax in comments intact while still expanding real values.

Severity

Minor — the example is a template meant to be copied first; no runtime/security impact on a real deployment. Filed so the example is runnable-as-shipped for anyone who tries it directly. (A one-paragraph networking note was already added to the example in commit b728117; this expansion issue is separate.)

## Background Found during the Network Access Control feature work. Pre-existing, not introduced by that feature. ## Problem `ROUTES_CONFIG=edge-router.example.toml cargo run` fails at startup with `Environment variable 'ER_VAR_NAME' is not set`. Root cause: `expand_env_refs` in `src/routes_config.rs` does raw-text `${...}` substitution over the **entire file content, including comments**, before `toml::from_str` ever parses it. The example file's TLS-section documentation comments contain literal `${VAR_NAME}` / `${CF_TOKEN}` tokens (as illustrative syntax), so expansion tries to resolve them as real env vars and aborts. Consequence: the shipped example file can't be run verbatim, only after a user copies and customizes it — which is the intended workflow, but the failure mode is a confusing hard error rather than anything pointing at "this is a template". ## Proposed fix Make `${...}` expansion comment-aware (skip `#`-comment regions), or perform expansion after TOML parse on string *values* only rather than raw file text. Either keeps the documented `${...}` syntax in comments intact while still expanding real values. ## Severity Minor — the example is a template meant to be copied first; no runtime/security impact on a real deployment. Filed so the example is runnable-as-shipped for anyone who tries it directly. (A one-paragraph networking note was already added to the example in commit `b728117`; this expansion issue is separate.)

james.oates referenced this issue

2026-08-03 13:11:17 +00:00

Composable per-listener access control (bindings, listeners, access rules) #3

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

IsoHex/edge-router#15

No description provided.

Rows
Columns