feat(admin): support authenticated Redis, and point at the external server

Adds REDIS_USERNAME and REDIS_PASSWORD. Both are optional, so an
unauthenticated instance still works unchanged. Redis 6+ ACL auth takes
both; a legacy requirepass instance takes the password with an empty
username, which is what go-redis needs to send single-argument AUTH.

Admin now defaults to the external Redis at 10.10.10.2:6379 rather than the
compose-local one, and no longer declares depends_on: redis -- it is not
starting that container any more. The base stack keeps its own Redis for
`server`, which still has no auth support.

Also fixes SMTP_PASSWORD in the admin block: it read `$SMTP_PASSWORD:-}`
rather than `${SMTP_PASSWORD:-}`, which appended a literal `:-}` to the
password and would have failed SMTP auth at the first verification email.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

admin/cmd/main.go

@@ -40,7 +40,7 @@ func main() {
 		log.Println("warning: SMTP not configured; verification and licence emails will fail")
 	}
 
-	auth.InitRedis(cfg.RedisAddr)
+	auth.InitRedis(cfg.RedisAddr, cfg.RedisUsername, cfg.RedisPassword)
 	pingCtx, pingCancel := context.WithTimeout(context.Background(), 10*time.Second)
 	if err := auth.Ping(pingCtx); err != nil {
 		pingCancel()

admin/internal/auth/session.go

@@ -30,7 +30,18 @@ type Session struct {
 
 var rdb *redis.Client
 
-func InitRedis(addr string) { rdb = redis.NewClient(&redis.Options{Addr: addr}) }
+// InitRedis connects the session store.
+//
+// Username and password may both be empty for an unauthenticated instance. For
+// a legacy `requirepass` Redis, pass the password with an empty username —
+// go-redis then sends AUTH with one argument instead of two.
+func InitRedis(addr, username, password string) {
+	rdb = redis.NewClient(&redis.Options{
+		Addr:     addr,
+		Username: username,
+		Password: password,
+	})
+}
 
 func Ping(ctx context.Context) error { return rdb.Ping(ctx).Err() }
 

admin/internal/config/config.go

@@ -18,6 +18,8 @@ type Config struct {
 	ControlMongoURI string
 	ControlDBName   string
 	RedisAddr       string
+	RedisUsername   string
+	RedisPassword   string
 	SigningKey      string
 	PublicURL       string
 	AllowedOrigins  []string
@@ -54,6 +56,11 @@ func Load() (Config, error) {
 		AdminMongoURI:   os.Getenv("ADMIN_MONGO_URI"),
 		ControlMongoURI: os.Getenv("CONTROL_MONGO_URI"),
 		RedisAddr:       os.Getenv("REDIS_ADDR"),
+		// Optional: an unauthenticated Redis needs neither. Redis 6+ ACL auth
+		// takes both; a legacy `requirepass` instance takes the password alone
+		// and must leave the username empty.
+		RedisUsername: os.Getenv("REDIS_USERNAME"),
+		RedisPassword: os.Getenv("REDIS_PASSWORD"),
 		SigningKey:      os.Getenv("LICENSE_SIGNING_KEY"),
 		PublicURL:       strings.TrimSuffix(os.Getenv("PUBLIC_URL"), "/"),
 		TrustProxy:      strings.EqualFold(os.Getenv("TRUST_PROXY"), "true"),

deploy/docker-compose.site.yml

@@ -3,10 +3,9 @@ services:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/site:latest
         restart: unless-stopped
         ports:
-            - 3001:3000
+            - 3002:3000
         depends_on:
             - sitesvc
-
     sitesvc:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/sitesvc:latest
         restart: unless-stopped
@@ -15,21 +14,16 @@ services:
         environment:
             PORT: "8082"
             MONGO_URI: ${MONGO_URI:-}
-            PUBLIC_URL: ${SITE_PUBLIC_URL:-}
-            APP_LOGIN_URL: ${SITE_APP_LOGIN_URL:-}
+            PUBLIC_URL: ${PUBLIC_URL:-}
+            APP_LOGIN_URL: ${APP_LOGIN_URL:-}
             SITE_ORIGIN: ${SITE_ORIGIN:-}
             TRUST_PROXY: ${SITE_TRUST_PROXY:-false}
-            SMTP_HOST: ${SITE_SMTP_HOST:-}
-            SMTP_PORT: ${SITE_SMTP_PORT:-587}
-            SMTP_USERNAME: ${SITE_SMTP_USERNAME:-}
-            SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
-            SMTP_FROM: ${SITE_SMTP_FROM:-}
-            SMTP_TO: ${SITE_SMTP_TO:-support@hostxtra.co.uk}
-
-    # The licensing authority. LICENSE_SIGNING_KEY appears in exactly one
-    # service in exactly one compose file: here. It must never be added to
-    # `server`, and docker-compose.yml -- the self-hosted deployment -- must
-    # not mention admin at all.
+            SMTP_HOST: ${SMTP_HOST:-}
+            SMTP_PORT: ${SMTP_PORT:-587}
+            SMTP_USERNAME: ${SMTP_USERNAME:-}
+            SMTP_PASSWORD: ${SMTP_PASSWORD:-}
+            SMTP_FROM: ${SMTP_FROM:-}
+            SMTP_TO: ${SMTP_TO:-support@hostxtra.co.uk}
     admin:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/admin:latest
         restart: unless-stopped
@@ -38,16 +32,17 @@ services:
         environment:
             PORT: "8083"
             ADMIN_MONGO_URI: ${ADMIN_MONGO_URI:-}
-            CONTROL_MONGO_URI: ${CONTROL_MONGO_URI:-}
-            REDIS_ADDR: redis:6379
+            CONTROL_MONGO_URI: ${MONGO_URI:-}
+            REDIS_ADDR: ${ADMIN_REDIS_ADDR:-10.10.10.2:6379}
+            REDIS_USERNAME: ${ADMIN_REDIS_USERNAME:-}
+            REDIS_PASSWORD: ${ADMIN_REDIS_PASSWORD:-}
             LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:-}
             PUBLIC_URL: ${ADMIN_PUBLIC_URL:-}
             ADMIN_ORIGIN: ${ADMIN_ORIGIN:-}
-            TRUST_PROXY: ${ADMIN_TRUST_PROXY:-true}
-            SMTP_HOST: ${SITE_SMTP_HOST:-}
-            SMTP_PORT: ${SITE_SMTP_PORT:-587}
-            SMTP_USERNAME: ${SITE_SMTP_USERNAME:-}
-            SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
-            SMTP_FROM: ${SITE_SMTP_FROM:-}
-        depends_on:
-            - redis
+            TRUST_PROXY: ${TRUST_PROXY:-true}
+            SMTP_HOST: ${SMTP_HOST:-}
+            SMTP_PORT: ${SMTP_PORT:-587}
+            SMTP_USERNAME: ${SMTP_USERNAME:-}
+            SMTP_PASSWORD: ${SMTP_PASSWORD:-}
+            SMTP_FROM: ${SMTP_FROM:-}
+networks: {}