Joakim
3b062edeb6
- Implemented complete Valkey infrastructure role following PostgreSQL patterns - Provides 100% Redis-compatible high-performance data structure store - Configured for multi-application support with database isolation - Security-focused: localhost-only binding, password auth, systemd hardening - Arch Linux compatible: uses native Valkey package with Redis compatibility - Database allocation strategy: DB 0 reserved, DB 1+ for applications - Full systemd integration with security overrides and proper service management - Redis client compatibility maintained for seamless application integration - Ready for Authentik and future container workloads requiring cache services
49 lines
1016 B
Django/Jinja
49 lines
1016 B
Django/Jinja
# Redis Systemd Security Override
|
|
# Generated by rick-infra Redis role
|
|
#
|
|
# This file provides additional security hardening for the Redis service
|
|
# following the same security patterns as the PostgreSQL role.
|
|
|
|
[Service]
|
|
# Security hardening
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
|
|
# Network security
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
|
|
# Filesystem permissions
|
|
ReadWritePaths=/var/lib/valkey
|
|
ReadOnlyPaths=/etc/valkey
|
|
|
|
# System call filtering
|
|
SystemCallFilter=@system-service
|
|
SystemCallFilter=~@privileged @resources @obsolete
|
|
|
|
# Memory and resource limits
|
|
MemoryDenyWriteExecute=yes
|
|
LockPersonality=yes
|
|
|
|
# Capabilities
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
|
|
# User and group isolation
|
|
DynamicUser=no
|
|
User=valkey
|
|
Group=valkey
|
|
|
|
# Process isolation
|
|
PrivateUsers=yes
|
|
RemoveIPC=yes
|
|
|
|
# Additional Redis-specific security
|
|
UMask=0027 |