Skip to main content
Redis is installed on application and cache servers. On a Shipways machine it listens on loopback only, so nothing outside the server can reach it whatever the firewall says.

​
The Redis password

A second lock rather than the only one. It matters when something else on the box is compromised: an unauthenticated Redis hands over every session and every cached query to anything that can open the socket, including a PHP process that has been talked into making a connection it should not. Set it from a server’s Runtime tab.
Setting a password locks out every application on this server until each one has it in its environment as REDIS_PASSWORD. That includes queue workers, which hold their configuration until they restart.
The password is kept encrypted and never shown again. Copy it somewhere before you save. There is no way to read it back — rotating is how you get a value you can see.

​
Removing it

Redis goes back to answering anything that can reach it on the machine. Take REDIS_PASSWORD out of every application’s environment as well. Redis answers an AUTH it never asked for with an error, so a site still sending one breaks the moment the password is gone — the opposite way round from what people expect.

​
The order to do it in

  1. Set the password in the panel.
  2. Add REDIS_PASSWORD to each site’s environment file. Saving it rebuilds the configuration cache.
  3. Restart the queue workers, which are still holding the old configuration.
There is no way to do this without a gap. Doing it during maintenance is the usual answer.