Troubleshooting¶
In the app¶
The most common everyday questions – wrong account, drive does not appear, access not yet granted, forgotten password – are answered in the user guide: Common questions and problems.
Other cases:
| Symptom | Cause / solution |
|---|---|
| Windows: “WinFsp is not installed or cannot be loaded” | Install WinFsp 2.1 or later (Installation), then restart Krywerk |
| macOS: “FUSE-T … not installed” | Install FUSE-T; Krywerk also starts without it but cannot mount anything |
| Linux: “/dev/fuse is missing …” | Load the FUSE module (sudo modprobe fuse) and install the fuse3 package; in containers, expose /dev/fuse |
| Linux: window stays empty or closes immediately | WebKitGTK 4.1 is missing or there is a graphics driver problem: start Krywerk from a terminal and check the messages; try WEBKIT_DISABLE_COMPOSITING_MODE=1 |
| Linux: “Remember password” does not work | No keyring in the session (KWallet or GNOME Keyring required) |
| Linux: no system tray icon (GNOME) | Install the extension AppIndicator and KStatusNotifierItem Support |
| Notice “The settings were corrupted …” | Krywerk has saved the old file as config.json.defekt-<time>; add the drives again or repair the file |
| “The server refuses unlocking because of its license (HTTP 402)” | Only applies to Cryptomator Hub; renew the license with the hub operator |
| Drive is slow, changes from other devices appear late | Settings › General › Advanced › turn the cache off or on (takes effect the next time you mount) |
What the log contains and where it is stored: Configuration › App log.
Krywerk Server¶
| Symptom | Cause / solution |
|---|---|
check: “Discovery reports issuer … instead of …” |
KRYWERK_SERVER_OIDC_ISSUER must exactly match the iss of the tokens (without a trailing /) |
check: provider not reachable |
Check OIDC_INTERNAL_URL; the server needs outbound access to the provider; own CA → SSL_CERT_FILE |
| Apps: “Server not trustworthy” | public_url/KRYWERK_DOMAIN must use HTTPS; the apps accept HTTP only for localhost |
| All requests return 401 | Server clock (NTP), issuer, or OIDC_AUDIENCE set incorrectly; tokens of a different client (azp) – then check OIDC_CLIENT_ID or OIDC_ALLOWED_CLIENTS |
| All requests return 403 | Role user is missing (default role in the realm), or clear ROLE_USER if the provider does not supply roles |
| “Not allowed to create team folders” | Assign the create-vaults role |
| Group cannot be found | A member must have signed in once; is the group claim in the token? (GROUPS_CLAIM) |
restore: “still responding” |
Stop the server first (restore.sh does this) |
| Web administration: “Invalid parameter: redirect_uri” at the identity provider | Add the redirect URI https://<KRYWERK_DOMAIN>/verwaltung/anmeldung to the client krywerk-verwaltung |
| Web administration: “Session expired” on every form | The proxy overrides Referrer-Policy with no-referrer (browsers then send Origin: null) – use ?Referrer-Policy in Caddy |
| Web administration: 403 “only from the internal network” | Adjust the Caddy block @verwaltung_extern |
| Web administration: no “People” menu | Role admin is missing in the token (roles claim) |
| HTTP 429 “too many requests” | Rate limiting per IP (rate_limit.*); behind a proxy set trust_proxy, otherwise all users share the proxy’s IP |
| Server does not start: “unknown option” | Typo in the TOML file; krywerk-server check names the option |
| Server does not start: database is newer | A newer version has migrated the database; reinstall that version or restore a backup from before |