My issue
When attempting to log in with a local user (no other possibility has been configured), I get the following error:
Unauthorized (cannot find sessions.DAO)
and the logs show:
ERROR pydio.rest.frontend Cannot resolve DAO: could not find compatible storage for DAO parameter: dao resolution failed
And, sure enough, when restarting Cells, I get these entries:
JSON logs
{"level":"info","ts":"2025-09-01T12:55:18+01:00","logger":"pydio.caddy.tls","msg":"finished cleaning storage units"}
{"level":"warn","ts":"2025-09-01T17:25:07+01:00","logger":"pydio.caddy.http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":":8032","duration":0.879121858,"request":{"client_ip":"127.0.0.1","headers":{"User-Agent":[""],"X-Forwarded-For":["127.0.0.1"],"X-Forwarded-Host":["127.0.0.1:8443"],"X-Forwarded-Proto":["https"],"X-Pydio-Site-Hash":["---[REDACTED]---"],"X-Real-Ip":["127.0.0.1:40700"]},"host":"127.0.0.1:8443","method":"GET","proto":"HTTP/1.1","remote_ip":"127.0.0.1","remote_port":"40700","tls":{"cipher_suite":4865,"proto":"","resumed":false,"server_name":"","version":772},"uri":"/"},"error":"writing: write tcp 127.0.0.1:8443->127.0.0.1:40700: write: broken pipe"}
{"level":"error","ts":"2025-09-01T17:25:28+01:00","logger":"pydio.rest.frontend","msg":"Cannot resolve DAO: could not find compatible storage for DAO parameter: dao resolution failed"}
{"level":"info","ts":"2025-09-01T17:25:36+01:00","logger":"pydio.caddy.http","msg":"servers shutting down with eternal grace period"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.web.proxy","msg":"Starting caddy as reverse-proxy"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","msg":"Registered Queue queue-debouncer with pool from uri mem://?debounce={{ .debounce }}&idle={{ .idle }}&max={{ .max }}&openerID={{ .openerID }}"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","msg":"Registered Queue queue-persistent with pool from uri fifo://{{ autoMkdir ( serviceDataDir .Service ) }}?name={{ .name }}&prefix={{ .prefix }}"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","msg":"Registered Cache cache-shared with pool from uri bigcache://?evictionTime={{ .evictionTime }}&cleanWindow={{ .cleanWindow }}&prefix={{ .prefix }}"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","msg":"Registered Cache cache-local with pool from uri pm://?evictionTime={{ .evictionTime }}&cleanWindow={{ .cleanWindow }}&prefix={{ .prefix }}"}
{"level":"warn","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.caddy.admin","msg":"admin endpoint disabled"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.caddy.tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00243af00"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.rest.policy","msg":"starting","service":"pydio.rest.policy","hook router to":"/policy","tag":"idm"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.rest.acl","msg":"starting","service":"pydio.rest.acl","hook router to":"/acl","tag":"idm"}
{"level":"warn","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.caddy.tls","msg":"stapling OCSP","error":"no OCSP stapling for [127.0.0.1]: no OCSP server specified in certificate"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.caddy.http.auto_https","msg":"skipping automatic certificate management becauseone or more matching certificates are already loaded","domain":"127.0.0.1","server_name":"srv0"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.caddy.http.auto_https","msg":"automatic HTTP->HTTPS redirects are disabled","server_name":"srv0"}
{"level":"info","ts":"2025-09-01T17:25:40+01:00","logger":"pydio.caddy.http","msg":"enabling HTTP/3 listener","addr":":8443"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
...
{"level":"warn","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.tls","msg":"stapling OCSP","error":"no OCSP stapling for [127.0.0.1]: no OCSP server specified in certificate"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.gateway.wopi","msg":"ready"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.http.auto_https","msg":"skipping automatic certificate management becauseone or more matching certificates are already loaded","server_name":"srv0","domain":"127.0.0.1"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.http.auto_https","msg":"automatic HTTP->HTTPS redirects are disabled","server_name":"srv0"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.grpc.install","msg":"ready"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.http","msg":"enabling HTTP/3 listener","addr":":8443"}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"info","ts":"2025-09-01T17:25:41+01:00","logger":"pydio.caddy.http","msg":"servers shutting down with eternal grace period"}
...
{"level":"warn","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.admin","msg":"admin endpoint disabled"}
{"level":"warn","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.tls","msg":"stapling OCSP","error":"no OCSP stapling for [127.0.0.1]: no OCSP server specified in certificate"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.http.auto_https","msg":"skipping automatic certificate management becauseone or more matching certificates are already loaded","domain":"127.0.0.1","server_name":"srv0"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.http.auto_https","msg":"automatic HTTP->HTTPS redirects are disabled","server_name":"srv0"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.grpc.jobs","msg":"ready"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.http","msg":"enabling HTTP/3 listener","addr":":8443"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.http.log","msg":"server running","protocols":["h1","h2","h3"],"name":"srv0"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.caddy.http","msg":"servers shutting down with eternal grace period"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.grpc.data.index","msg":"ready"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.grpc.oauth","msg":"ready"}
...
And now the juicy bits:
{"level":"error","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.grpc.install","msg":"could not initialise service at version 4.9.92-alpha08","e
rror":"could not find compatible storage for DAO parameter: dao resolution failed","errorVerbose":"could not find compatible storage for DAO para
meter: dao resolution failed\ngithub.com/pydio/cells/v5/common/runtime/manager.Resolve[...]\n\tgithub.com/pydio/cells/v5/common/runtime/manager/r
esolve.go:249\ngithub.com/pydio/cells/v5/idm/role/grpc.InitRoles\n\tgithub.com/pydio/cells/v5/idm/role/grpc/first-run.go:51\ngithub.com/pydio/cel
ls/v5/common/service.applyMigrations\n\tgithub.com/pydio/cells/v5/common/service/versions.go:240\ngithub.com/pydio/cells/v5/common/service.UpdateServiceVersion\n\tgithub.com/pydio/cells/v5/common/service/versions.go:119\ngithub.com/pydio/cells/v5/discovery/install/grpc.(*Handler).Migrate\n\tgithub.com/pydio/cells/v5/discovery/install/grpc/handler.go:144\nreflect.Value.call\n\treflect/value.go:584\nreflect.Value.Call\n\treflect/value.go:368\ngithub.com/pydio/cells/v5/common/server/grpc.(*Server).prepareInternalOptions.func1\n\tgithub.com/pydio/cells/v5/common/server/grpc/grpc.go:300\ngithub.com/pydio/cells/v5/common/server/grpc.getChainUnaryHandler.func1\n\tgithub.com/pydio/cells/v5/common/server/grpc/interceptor.go:23\ngithub.com/pydio/cells/v5/common/server/grpc.(*Server).prepareInternalOptions.func2\n\tgithub.com/pydio/cells/v5/common/server/grpc/grpc.go:318\ngithub.com/pydio/cells/v5/common/server/grpc.(*Server).prepareInternalOptions.HandlerUnaryInterceptor.func6\n\tgithub.com/pydio/cells/v5/common/server/grpc/interceptor.go:14\ngoogle.golang.org/grpc.getChainUnaryHandler.func1.getChainUnaryHandler.1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/server/grpc.(*Server).prepareInternalOptions.unaryEndpointInterceptor.func5\n\tgithub.com/pydio/cells/v5/common/server/grpc/grpc-endpoint.go:79\ngoogle.golang.org/grpc.getChainUnaryHandler.func1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.ErrorFormatUnaryInterceptor\n\tgithub.com/pydio/cells/v5/common/middleware/errors-grpc.go:79\ngoogle.golang.org/grpc.getChainUnaryHandler.func1.getChainUnaryHandler.1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.ContextUnaryServerInterceptor.func10\n\tgithub.com/pydio/cells/v5/common/utils/propagator/grpc.go:43\ngoogle.golang.org/grpc.getChainUnaryHandler.func1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.ContextUnaryServerInterceptor.func9\n\tgithub.com/pydio/cells/v5/common/utils/propagator/grpc.go:43\ngoogle.golang.org/grpc.getChainUnaryHandler.func1.getChainUnaryHandler.1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.ContextUnaryServerInterceptor.func7\n\tgithub.com/pydio/cells/v5/common/utils/propagator/grpc.go:43\ngoogle.golang.org/grpc.getChainUnaryHandler.func1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.ContextUnaryServerInterceptor.func5\n\tgithub.com/pydio/cells/v5/common/utils/propagator/grpc.go:43\ngoogle.golang.org/grpc.getChainUnaryHandler.func1.getChainUnaryHandler.1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/grpc-ecosystem/go-grpc-middleware/recovery.UnaryServerInterceptor.func1\n\tgithub.com/grpc-ecosystem/go-grpc-middleware@v1.4.0/recovery/interceptors.go:33\ngoogle.golang.org/grpc.getChainUnaryHandler.func1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.ContextUnaryServerInterceptor.func4\n\tgithub.com/pydio/cells/v5/common/utils/propagator/grpc.go:43\ngoogle.golang.org/grpc.getChainUnaryHandler.func1.getChainUnaryHandler.1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.ContextUnaryServerInterceptor.func2\n\tgithub.com/pydio/cells/v5/common/utils/propagator/grpc.go:43\ngoogle.golang.org/grpc.getChainUnaryHandler.func1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1212\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryServerInterceptors.MetricsUnaryServerInterceptor.func1\n\tgithub.com/pydio/cells/v5/common/middleware/metrics.go:59\ngoogle.golang.org/grpc.NewServer.chainUnaryServerInterceptors.chainUnaryInterceptors.func1\n\tgoogle.golang.org/grpc@v1.69.2/server.go:1203\n","tag":"idm"}
{"level":"info","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.grpc.install","msg":"Error while updating service version for pydio.grpc.role","error":"cannot update service version for pydio.grpc.role (could not find compatible storage for DAO parameter: dao resolution failed)","tag":"idm"}
{"level":"error","ts":"2025-09-01T17:25:42+01:00","logger":"pydio.grpc.install","msg":"[GRPC]/service.MigrateService/Migrate cannot update service version for pydio.grpc.role (could not find compatible storage for DAO parameter: dao resolution failed)","errorId":"2757b86f-f105","ClientCaller":"github.com/pydio/cells/v5/cmd/start.go:386:cmd.init.func86()","error":"cannot update service version for pydio.grpc.role (could not find compatible storage for DAO parameter: dao resolution failed)"}
{"level":"warn","ts":"2025-09-01T17:25:42+01:00","msg":"Ignoring migration failure","error":"rpc error: code = Unknown desc = cannot update service version for pydio.grpc.role (could not find compatible storage for DAO parameter: dao resolution failed)\nhandled\nhandled","errorVerbose":"rpc error: code = Unknown desc = cannot update service version for pydio.grpc.role (could not find compatible storage for DAO parameter: dao resolution failed)\nhandled\nhandled\ngithub.com/pydio/cells/v5/common/errors.Tag\n\tgithub.com/pydio/cells/v5/common/errors/lib.go:102\ngithub.com/pydio/cells/v5/common/middleware.FromGRPC\n\tgithub.com/pydio/cells/v5/common/middleware/errors-grpc.go:235\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryClientInterceptors.ErrorFormatUnaryClientInterceptor.func2\n\tgithub.com/pydio/cells/v5/common/middleware/errors-grpc.go:93\ngoogle.golang.org/grpc.getChainUnaryInvoker.func1\n\tgoogle.golang.org/grpc@v1.69.2/clientconn.go:470\ngithub.com/pydio/cells/v5/common/middleware.GrpcUnaryClientInterceptors.ErrorNoMatchedRouteRetryUnaryClientInterceptor.func1\n\tgithub.com/pydio/cells/v5/common/middleware/errors-grpc.go:51\ngoogle.golang.org/grpc.NewClient.chainUnaryClientInterceptors.func1\n\tgoogle.golang.org/grpc@v1.69.2/clientconn.go:458\ngoogle.golang.org/grpc.(*ClientConn).Invoke\n\tgoogle.golang.org/grpc@v1.69.2/call.go:35\ngithub.com/pydio/cells/v5/common/client/grpc.(*clientConn).Invoke\n\tgithub.com/pydio/cells/v5/common/client/grpc/grpc.go:269\ngithub.com/pydio/cells/v5/common/proto/service.(*migrateServiceClient).Migrate\n\tgithub.com/pydio/cells/v5/common/proto/service/cells-service_grpc.pb.go:242\ngithub.com/pydio/cells/v5/cmd.init.func86\n\tgithub.com/pydio/cells/v5/cmd/start.go:386\ngithub.com/spf13/cobra.(*Command).execute\n\tgithub.com/spf13/cobra@v1.9.1/command.go:1015\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\tgithub.com/spf13/cobra@v1.9.1/command.go:1148\ngithub.com/spf13/cobra.(*Command).Execute\n\tgithub.com/spf13/cobra@v1.9.1/command.go:1071\ngithub.com/spf13/cobra.(*Command).ExecuteContext\n\tgithub.com/spf13/cobra@v1.9.1/command.go:1064\ngithub.com/pydio/cells/v5/cmd.Execute\n\tgithub.com/pydio/cells/v5/cmd/root.go:125\nmain.main\n\tgithub.com/pydio/cells/v5/main.go:203\nruntime.main\n\truntime/proc.go:283\nruntime.goexit\n\truntime/asm_amd64.s:1700\n"}
Fun, isn’t it?
My question is actually a simple one: what exactly is “DAO” and how do I get it to behave?
I’m sure it’s nothing that my acronym database has found:
$ wtf DAO
DAO Data Access Objects (DB)
DAO Destination Address Omitted [flag] (CATNIP)
DAO Disk At Once (CD-R, SAO)
What version of Cells are you using?
4.9.92-alpha08 (aye, I know: it’s an alpha version!), Home Edition
What is the server OS? Database name/version? Browser name or mobile device description (if issue appears client-side)?
OS: Ubuntu Linux 24.04.3 LTS (kernel 6.8.0-79)
Database server: MariaDB Ver 15.1 Distrib 10.11.13
To make things more complicted (or perhaps not), I run this version of Pydio Cells in three layers.
- Layer one: There is no Docker or VM — Cells runs directly on metal (it needs all the CPU is can!). It’s bound to
127.0.0.1. - Layer two: Nginx reverse proxy (for both HTTP/S traffic as well as gRPC). Stable configuration for years. Local hostname has a Let’s Encrypt ECC certificate. Local firewall (ufw/iptables) configured and also operational for years.
- Layer three: Firewall at the data centre layer. No issues there for years as well (but sometimes I turn it off to be really sure).
(Production version runs sometimes under the Cloudflare umbrella as well, but to keep things easier to debug and configure, this alpha version doesn’t)
While the logs are a bit obscure here, I think there is some kind of communications problem between Caddy and one of the many gRPC serverlets — error "no OCSP stapling for [127.0.0.1]: no OCSP server specified in certificate" is highly suspicious, since Let’s Encrypt has discontinued OCSP stapling quite a while ago[1].
I wonder, therefore, if it’s Caddy that is requesting OCSP stapling for this certificate, fails to retrieve it (because Let’s Encrypt certificates already don’t mention the OCSP endpoint), crashes or something similar, and some services, namely the mysterious “DAO”, stop working.
If that’s the case, my guess is that the simple fix would be to disable OCSP stapling requests in Caddy, and all else would work. Right?
There is one file for my domain under .config/pydio/cells/caddy/ocsp — it’s dated from Oct. 12, 2022 (!). Should I remove it?
What steps have you taken to resolve this issue already?
Uh, none, to be honest… I read some Web pages and did some searches on Google, in vain!
I did set "disable_ocsp_stapling": true inside .config/pydio/cells/caddy/autosave.json, but it had no effect; I presume that Caddy is really using a different configuration file, injected directly by Cells.
One thing what I did try to change was the self-signed certificate for Caddy, and replace it with the real certificate. This didn’t work out as intended: Caddy seems to be even more confused, and still tries to use its own self-signed certificates, but now fails with a weird error:
ERROR pydio.caddy.pki.ca.local failed to install root certificate {"error": "failed to execute sudo: exit status 1", "certificate_file": "storage:pki/authorities/local/root.crt"}
Erm… no, I most definitely do not want Cells or Caddy to get sudo access on that machine!
Whatever it was trying to do, in any case, it failed, and the remaining errors are as listed before — it’s still complaining about could not find compatible storage for DAO parameter: dao resolution failed. No luck there! 
Also see a relevant discussion on the Let’s Encrypt Community Forums: What will happen to Must-Staple - #26 by jvanasco - Issuance Policy - Let's Encrypt Community Support ↩︎
The code is intricate and complex (and I love Go 
!) but, to fully understand it, it would take much more time than what I have at my disposal right now.
hey