[BUG] Nix module's empty SSLKEYLOGFILE environment variable is breaking other software #300

amartin commented 2026年05月29日 00:39:17 +02:00

Confirmation Checklist

• I confirm that this issue occurs on the latest release of Phoenix. You can check what the latest version is on the Releases page.
• I confirm that this issue has NOT already been reported on the Codeberg issue tracker, the GitLab issue tracker, and/or the GitHub issue tracker.

What web browser(s) are you using with Phoenix?

Firefox Developer Edition

Other

No response

What operating system(s) are you experiencing this issue on?

NixOS

Other

No response

What version of Firefox/Gecko and Phoenix are you using?

152.0b1 (Phoenix: 2026年05月21日.2)

If you remember, what version of Firefox/Gecko and Phoenix did you first notice the issue on?

No response

Does the issue occur on a new browser profile?

• Yes
• No

Please share your browser's distribution ID.

Not relevant here

Please share your browser's update channel.

Not relevant here

Please share a list of your currently installed browser add-ons/extensions, as well as the versions you have installed.

Not relevant here

Please explain the issue you are experiencing.

When the Phoenix NixOS module sets the environment variable SSLKEYLOGFILE to an empty string, it causes runtime errors in Elixir and Erlang applications that use HTTP client libraries like Finch (which is the default in the Elixir Phoenix framework) or Req. These libraries try to open the file path in SSLKEYLOGFILE if it is set, even if it is empty. This results in a crash with a "could not open "": no such file or directory" error. The problem is not specific to Elixir but affects any software that expects SSLKEYLOGFILE to be either unset or a valid file path.

I've been debugging and quite frustrated for a long time today because my codebase was working the last time I touched that project 3 months ago (before installing Phoenix as a NixOS module), and suddenly it was throwing this cryptic error that I couldn't even find answers to online. I'm wondering if it's really necessary to set that environment variable, since if it causes problems in Elixir, I suppose it causes problems elsewhere, especially since it's empty?

Please provide detailed steps to reproduce the issue.

1. Enable the Phoenix NixOS module or otherwise set SSLKEYLOGFILE to an empty string in your environment
2. Open a shell and run any Elixir or Erlang application that uses HTTP over SSL, for example:

$ iex -S mix
{:ok, _pid} = Finch.start_link(name: TestFinch)

3. The application will crash with a file error when trying to open SSLKEYLOGFILE as a file

---

I don't really have another example to reproduce right now, sorry if this makes things more complicated. Please also let me know if you'd prefer I open an issue in the Finch repository; I'm not sure which would be more appropriate. Thanks in advance.

### Confirmation Checklist - [x] I confirm that this issue occurs on the **latest release** of Phoenix. You can check what the latest version is on [the `Releases` page](https://codeberg.org/celenity/Phoenix/releases). - [x] I confirm that this issue has **NOT** already been reported on [the Codeberg issue tracker](https://codeberg.org/celenity/Phoenix/issues), [the GitLab issue tracker](https://gitlab.com/celenityy/Phoenix/-/issues), **and/or** [the GitHub issue tracker](https://github.com/celenityy/Phoenix/issues). ### What web browser(s) are you using with Phoenix? Firefox Developer Edition ### Other _No response_ ### What operating system(s) are you experiencing this issue on? NixOS ### Other _No response_ ### What version of Firefox/Gecko and Phoenix are you using? 152.0b1 (Phoenix: 2026年05月21日.2) ### If you remember, what version of Firefox/Gecko and Phoenix did you first notice the issue on? _No response_ ### Does the issue occur on a new browser profile? - [ ] Yes - [x] No ### Please share your browser's distribution ID. Not relevant here ### Please share your browser's update channel. Not relevant here ### Please share a list of your currently installed browser add-ons/extensions, as well as the versions you have installed. Not relevant here ### Please explain the issue you are experiencing. When the Phoenix NixOS module sets the environment variable `SSLKEYLOGFILE` to an empty string, it causes runtime errors in Elixir and Erlang applications that use HTTP client libraries like Finch (which is the default in the Elixir Phoenix framework) or Req. These libraries try to open the file path in `SSLKEYLOGFILE` if it is set, even if it is empty. This results in a crash with a "could not open "": no such file or directory" error. The problem is not specific to Elixir but affects any software that expects `SSLKEYLOGFILE` to be either unset or a valid file path. I've been debugging and quite frustrated for a long time today because my codebase was working the last time I touched that project 3 months ago (before installing Phoenix as a NixOS module), and suddenly it was throwing this cryptic error that I couldn't even find answers to online. I'm wondering if it's really necessary to set that environment variable, since if it causes problems in Elixir, I suppose it causes problems elsewhere, especially since it's empty? ### Please provide detailed steps to reproduce the issue. 1. Enable the Phoenix NixOS module or otherwise set `SSLKEYLOGFILE` to an empty string in your environment 2. Open a shell and run any Elixir or Erlang application that uses HTTP over SSL, for example: ```bash $ iex -S mix {:ok, _pid} = Finch.start_link(name: TestFinch) ``` 3. The application will crash with a file error when trying to open `SSLKEYLOGFILE` as a file --- I don't really have another example to reproduce right now, sorry if this makes things more complicated. Please also let me know if you'd prefer I open an issue in the Finch repository; I'm not sure which would be more appropriate. Thanks in advance.

celenity commented 2026年05月29日 23:04:43 +02:00

@amartin Thank you!

I've now made it so the environment variables are properly unset, instead of being set to an empty string. For Nix, based on the docs, I set SSLKEYLOGFILE (and the other variables we want to unset) to null - which should work to avoid issues like this.

(On a side note, I really wish we could set environment variables for Firefox only - instead of setting them on the system level, but unfortunately I don't know of a reliable way that we can do that ATM).

Please also let me know if you'd prefer I open an issue in the Finch repository; I'm not sure which would be more appropriate.

IMO this is still worth reporting to Finch as well - they should probably add a check to ensure SSLKEYLOGFILE is set to a valid file path before attempting to write to it.

@amartin Thank you! I've now made it so the environment variables are properly unset, instead of being set to an empty string. For Nix, based on [the docs](https://search.nixos.org/options?channel=unstable&query=environment.variables#show=option%253Aenvironment.variables), I set `SSLKEYLOGFILE` *(and the other variables we want to unset)* to `null` - which should work to avoid issues like this. *(On a side note, I really wish we could set environment variables for Firefox only - instead of setting them on the system level, but unfortunately I don't know of a reliable way that we can do that ATM)*. > Please also let me know if you'd prefer I open an issue in the Finch repository; I'm not sure which would be more appropriate. IMO this is still worth reporting to Finch as well - they should probably add a check to ensure `SSLKEYLOGFILE` is set to a valid file path before attempting to write to it.

amartin commented 2026年05月30日 00:16:14 +02:00

Thank you so much for the quick response and the fix!

I'll also report the issue to Finch. Cheers! :)

Thank you so much for the quick response and the fix! I'll also report the issue to Finch. Cheers! :)