"Failed to start the daemon" err="Failed applying patch "auth_open fga_instance_tcp" after upgrade

Incus
1

Hello all,

Back from holidays and after updated the system I found than incus daemon doesn’t start.
I have oidc auth set up and and experimental instance of openfga.

I guess that reworked authorization configuration in 7.3 might be involved in the issue.

Here is output for systemctl status incus and incus/config.yml file. incus.socket is up.

Sep 01 15:30:03 carlos-E70-SFF incusd[16509]: time="2026-09-01T15:30:03+02:00" level=error msg="Failed to start the daemon" err="Failed applying patch \"auth_openfga_instance_tcp\": Failed to write the authorization model: Post \"https://openfga.home.local:8080/stores/01KRP4Q28W7Z1Z8MRPFWH5XNJR/authorization-models\": dial tcp: lookup openfga.home.local: no such host"
Sep 01 15:30:03 carlos-E70-SFF incusd[16509]: Error: Failed applying patch "auth_openfga_instance_tcp": Failed to write the authorization model: Post "https://openfga.ies.grao:8080/stores/01KRP4Q28W7Z1Z8MRPFWH5XNJR/authorization-models": dial tcp: lookup openfga.home.local: no such host
Sep 01 15:30:03 carlos-E70-SFF systemd[1]: incus.service: Main process exited, code=exited, status=1/FAILURE


  local:
    addr: unix://
    project: default
    protocol: incus
    public: false
  local-oidc:
    addr: https://localhost:8443
    auth_type: oidc
    protocol: incus
    public: false

I tried to downgrade to prior version of incus but dependencies is a mess.

Any help would be appreciated.

Thanks.

2

You’ve got OpenFGA configured and your OpenFGA server isn’t responding. Fixing it should unstick things.

3

Yes, the problem is that OpenFGA server is an incus container and i don’t know how to access it as incusd isn’t running because of some error starting openfga instance…chicken egg problem?

I am thinking of remove the instance files manually but I might break the incus server.

4

Ah right, yeah, such updates can be fun…

Easiest way would probably be to put something like:

DELETE FROM config WHERE key LIKE 'authorization.openfga.%'

In /var/lib/incus/database/patch.global.sql

Then when Incus starts up, it will clear your OpenFGA config. You can then re-apply it later which will then refresh the OpenFGA model.

5

It worked!!
Thanks a lot!!