> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shipways.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Redis

> The cache, and the password that locks it.

Redis is installed on **application** and **cache** servers. On a Shipways
machine it listens on loopback only, so nothing outside the server can reach it
whatever the firewall says.

## The Redis password

A second lock rather than the only one. It matters when something else on the
box is compromised: an unauthenticated Redis hands over every session and every
cached query to anything that can open the socket, including a PHP process that
has been talked into making a connection it should not.

Set it from a server's **Runtime** tab.

<Warning>
  Setting a password locks out **every application on this server** until each
  one has it in its environment as `REDIS_PASSWORD`. That includes queue workers,
  which hold their configuration until they restart.
</Warning>

The password is kept encrypted and **never shown again**. Copy it somewhere
before you save. There is no way to read it back — rotating is how you get a
value you can see.

### Removing it

Redis goes back to answering anything that can reach it on the machine.

Take `REDIS_PASSWORD` out of every application's environment as well. Redis
answers an `AUTH` it never asked for with an error, so a site still sending one
breaks the moment the password is gone — the opposite way round from what
people expect.

### The order to do it in

1. Set the password in the panel.
2. Add `REDIS_PASSWORD` to each site's [environment file](/sites/environment).
   Saving it rebuilds the configuration cache.
3. Restart the [queue workers](/processes/daemons), which are still holding the
   old configuration.

There is no way to do this without a gap. Doing it during
[maintenance](/sites/maintenance) is the usual answer.