From bcc44fd44a7d0955516ed27759c4d62ce3b7a561 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Fri, 31 Jul 2026 09:36:31 +0100 Subject: [PATCH] feat: authenticate the server's Redis connection InitRedis now takes a username and password, read from REDIS_USERNAME and REDIS_PASSWORD, matching what admin has always done. Both empty keeps an unauthenticated Redis working; a password with an empty username is what a legacy requirepass instance needs, since go-redis then sends AUTH with one argument instead of two. This is what lets a Kubernetes install point at a managed Redis instead of the bundled one. --- docs/reference/environment-variables.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/reference/environment-variables.md b/docs/reference/environment-variables.md index 76e4187..d9e9e60 100644 --- a/docs/reference/environment-variables.md +++ b/docs/reference/environment-variables.md @@ -14,6 +14,8 @@ it is absent. | `GRPC_HOST` | **yes** | | The `host:port` agents dial. Boot fails without it. There is deliberately no fallback to the web host: that would hand every agent a port that does not speak gRPC | | `MONGO_URI` | no | `mongodb://localhost:27017` | The database name is taken from the URI path, falling back to `vantage`. There is no separate `MONGO_DB` | | `REDIS_ADDR` | no | `localhost:6379` | Sessions only | +| `REDIS_USERNAME` | no | | Redis 6+ ACL user. Leave empty against a legacy `requirepass` instance, which authenticates with the password alone | +| `REDIS_PASSWORD` | no | | Leave empty for an unauthenticated Redis. Both of these exist so an install can use a managed Redis rather than the bundled one | | `KEY_ENCRYPTION_KEY` | yes in practice | | 64 hex characters (32 bytes) for AES-256-GCM. Required for private keys, vault secrets, OIDC client secrets and console credentials | | `GITEA_HOST` | yes | `gitea.example.com` | Used to build the install scripts and agent download URLs. The default is a placeholder that will not resolve | | `GUACD_ADDR` | no | `guacd:4822` | The [browser console](../vantage/browser-console.md) daemon |