mirror of
https://codeberg.org/redict/redict.git
synced 2025-01-21 23:58:51 -05:00
TLS.md: Redis => Redict
Not sure how I missed this yesterday. Signed-off-by: Drew DeVault <sir@cmpwn.com>
This commit is contained in:
parent
7e623bafcc
commit
13c235484a
42
TLS.md
42
TLS.md
@ -9,58 +9,58 @@ Getting Started
|
|||||||
To build with TLS support you'll need OpenSSL development libraries (e.g.
|
To build with TLS support you'll need OpenSSL development libraries (e.g.
|
||||||
libssl-dev on Debian/Ubuntu).
|
libssl-dev on Debian/Ubuntu).
|
||||||
|
|
||||||
To build TLS support as Redis built-in:
|
To build TLS support as Redict built-in:
|
||||||
Run `make BUILD_TLS=yes`.
|
Run `make BUILD_TLS=yes`.
|
||||||
|
|
||||||
Or to build TLS as Redis module:
|
Or to build TLS as Redict module:
|
||||||
Run `make BUILD_TLS=module`.
|
Run `make BUILD_TLS=module`.
|
||||||
|
|
||||||
Note that sentinel mode does not support TLS module.
|
Note that sentinel mode does not support TLS module.
|
||||||
|
|
||||||
### Tests
|
### Tests
|
||||||
|
|
||||||
To run Redis test suite with TLS, you'll need TLS support for TCL (i.e.
|
To run Redict test suite with TLS, you'll need TLS support for TCL (i.e.
|
||||||
`tcl-tls` package on Debian/Ubuntu).
|
`tcl-tls` package on Debian/Ubuntu).
|
||||||
|
|
||||||
1. Run `./utils/gen-test-certs.sh` to generate a root CA and a server
|
1. Run `./utils/gen-test-certs.sh` to generate a root CA and a server
|
||||||
certificate.
|
certificate.
|
||||||
|
|
||||||
2. Run `./runtest --tls` or `./runtest-cluster --tls` to run Redis and Redis
|
2. Run `./runtest --tls` or `./runtest-cluster --tls` to run Redict and Redict
|
||||||
Cluster tests in TLS mode.
|
Cluster tests in TLS mode.
|
||||||
|
|
||||||
3. Run `./runtest --tls-module` or `./runtest-cluster --tls-module` to
|
3. Run `./runtest --tls-module` or `./runtest-cluster --tls-module` to
|
||||||
run Redis and Redis cluster tests in TLS mode with Redis module.
|
run Redict and Redict cluster tests in TLS mode with Redict module.
|
||||||
|
|
||||||
### Running manually
|
### Running manually
|
||||||
|
|
||||||
To manually run a Redis server with TLS mode (assuming `gen-test-certs.sh` was
|
To manually run a Redict server with TLS mode (assuming `gen-test-certs.sh` was
|
||||||
invoked so sample certificates/keys are available):
|
invoked so sample certificates/keys are available):
|
||||||
|
|
||||||
For TLS built-in mode:
|
For TLS built-in mode:
|
||||||
./src/redis-server --tls-port 6379 --port 0 \
|
./src/redict-server --tls-port 6379 --port 0 \
|
||||||
--tls-cert-file ./tests/tls/redis.crt \
|
--tls-cert-file ./tests/tls/redict.crt \
|
||||||
--tls-key-file ./tests/tls/redis.key \
|
--tls-key-file ./tests/tls/redict.key \
|
||||||
--tls-ca-cert-file ./tests/tls/ca.crt
|
--tls-ca-cert-file ./tests/tls/ca.crt
|
||||||
|
|
||||||
For TLS module mode:
|
For TLS module mode:
|
||||||
./src/redis-server --tls-port 6379 --port 0 \
|
./src/redict-server --tls-port 6379 --port 0 \
|
||||||
--tls-cert-file ./tests/tls/redis.crt \
|
--tls-cert-file ./tests/tls/redict.crt \
|
||||||
--tls-key-file ./tests/tls/redis.key \
|
--tls-key-file ./tests/tls/redict.key \
|
||||||
--tls-ca-cert-file ./tests/tls/ca.crt \
|
--tls-ca-cert-file ./tests/tls/ca.crt \
|
||||||
--loadmodule src/redis-tls.so
|
--loadmodule src/redict-tls.so
|
||||||
|
|
||||||
To connect to this Redis server with `redis-cli`:
|
To connect to this Redict server with `redict-cli`:
|
||||||
|
|
||||||
./src/redis-cli --tls \
|
./src/redict-cli --tls \
|
||||||
--cert ./tests/tls/redis.crt \
|
--cert ./tests/tls/redict.crt \
|
||||||
--key ./tests/tls/redis.key \
|
--key ./tests/tls/redict.key \
|
||||||
--cacert ./tests/tls/ca.crt
|
--cacert ./tests/tls/ca.crt
|
||||||
|
|
||||||
This will disable TCP and enable TLS on port 6379. It's also possible to have
|
This will disable TCP and enable TLS on port 6379. It's also possible to have
|
||||||
both TCP and TLS available, but you'll need to assign different ports.
|
both TCP and TLS available, but you'll need to assign different ports.
|
||||||
|
|
||||||
To make a Replica connect to the master using TLS, use `--tls-replication yes`,
|
To make a Replica connect to the master using TLS, use `--tls-replication yes`,
|
||||||
and to make Redis Cluster use TLS across nodes use `--tls-cluster yes`.
|
and to make Redict Cluster use TLS across nodes use `--tls-cluster yes`.
|
||||||
|
|
||||||
Connections
|
Connections
|
||||||
-----------
|
-----------
|
||||||
@ -85,18 +85,18 @@ but there are probably other good reasons to improve that part anyway.
|
|||||||
To-Do List
|
To-Do List
|
||||||
----------
|
----------
|
||||||
|
|
||||||
- [ ] redis-benchmark support. The current implementation is a mix of using
|
- [ ] redict-benchmark support. The current implementation is a mix of using
|
||||||
hiredis for parsing and basic networking (establishing connections), but
|
hiredis for parsing and basic networking (establishing connections), but
|
||||||
directly manipulating sockets for most actions. This will need to be cleaned
|
directly manipulating sockets for most actions. This will need to be cleaned
|
||||||
up for proper TLS support. The best approach is probably to migrate to hiredis
|
up for proper TLS support. The best approach is probably to migrate to hiredis
|
||||||
async mode.
|
async mode.
|
||||||
- [ ] redis-cli `--slave` and `--rdb` support.
|
- [ ] redict-cli `--slave` and `--rdb` support.
|
||||||
|
|
||||||
Multi-port
|
Multi-port
|
||||||
----------
|
----------
|
||||||
|
|
||||||
Consider the implications of allowing TLS to be configured on a separate port,
|
Consider the implications of allowing TLS to be configured on a separate port,
|
||||||
making Redis listening on multiple ports:
|
making Redict listening on multiple ports:
|
||||||
|
|
||||||
1. Startup banner port notification
|
1. Startup banner port notification
|
||||||
2. Proctitle
|
2. Proctitle
|
||||||
|
Loading…
Reference in New Issue
Block a user