To implement encrypted communication between Redis masters and slaves, we recommend using stunnel. Stunnel works as TLS encryption wrapper between client and server.
This step-by-step tutorial will explain how to install and configure
stunnel proxies on FreeBSD client and server.
Configuration procedures for other operating systems are very similar. For simplicity, this tutorial only covers replication to one client host as this configuration does not require individual preshared keys for each of the clients.
Assuming we have 3 Redis instances on both
client, listening sockets on the
server (master side):
|instance||Redis socket||stunnel socket|
As the instance named
redis should not be mirrored, we will replicate
bayes instances. So we need to setup 2 TLS tunnels.
First install the
# pkg install stunnel
Create pid-file directory:
# mkdir /var/run/stunnel && chown stunnel:stunnel /var/run/stunnel
stunnel add the following lines to the
setuid = stunnel setgid = nogroup pid = /var/run/stunnel/stunnel.pid [bayes] accept = 6478 connect = 6378 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt [fuzzy] accept = 6477 connect = 6377 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt
setuid = stunnel setgid = nogroup pid = /var/run/stunnel/stunnel.pid [bayes] client = yes accept = localhost:6478 connect = master.example.com:6478 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt [fuzzy] client = yes accept = localhost:6477 connect = master.example.com:6477 ciphers = PSK PSKsecrets = /usr/local/etc/stunnel/psk.txt
psk.txt file contains one line for each client:
Do not use example passwords.
fuzzy Redis instances located at the same host we can share the same key between them.
Since this file should be kept secret set secure permissions on it:
# chmod 600 /usr/local/etc/stunnel/psk.txt
# service stunnel start
From the client host use the
redis-cli utility to connect to the remote instances:
# redis-cli -p 6477 # redis-cli -p 6478
Given that it connected, you are clear to proceed with configuring replication between Redis instances.