# Redis cluster
> [HTML Version](configure-redis.html)
For the correct operation of the system, Redis version 5 or 6.2 is required. The article describes the installation of Redis 6.2.12 for Ubuntu Linux 20.04 and 22.04. You can also refer to the guide in the [official Redis documentation](https://redis.io/docs/management/sentinel/).
````
начало внимание
````
Due to changes in the licensing policy of Redis, we recommend installing Valkey as an alternative solution. For detailed installation instructions, refer to the [Valkey cluster](cluster-redis-to-valkey.md) article.
````
конец внимание
````
Installation consists of five steps:
1. [Prepare nodes (servers)](#preparation-node).
2. [Install Redis and Sentinel](#installation).
3. [Configure Redis](#redis-setup).
4. [Configure Sentinel](#sentinel-setup).
5. [Connect to Redis](#connection-to-redis).
## Step 1: Prepare nodes (servers)
````
начало внимание
````
The minimum number of servers to organize a cluster is three.
````
конец внимание
1. ````
Create three nodes (servers) with sequentially numbered host names:
- **redis-server1.your\_domain**.
- **redis-server2.your\_domain**.
- **redis-server3.your\_domain**.
2. Create the necessary host name mappings in DNS. If this is not possible, add the required entries to \[OBJECT\].
## Step 2: Install Redis and Sentinel
1. Install the necessary packages:
````
sudo apt install lsb-release curl gpg
2. ````
Import the necessary keys and add the Redis repository:
````
curl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb \[signed-by=/usr/share/keyrings/redis-archive-keyring.gpg\] https://packages.redis.io/deb \$(lsb\_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list
3. ````
Update the package cache:
````
sudo apt-get update
4. ````
Install Redis:
````
sudo apt-get -y install redis=6:6.2.12-1rl1~\$(lsb\_release -cs)1 redis-server=6:6.2.12-1rl1~\$(lsb\_release -cs)1 redis-tools=6:6.2.12-1rl1~\$(lsb\_release -cs)1 redis-sentinel=6:6.2.12-1rl1~\$(lsb\_release -cs)1
## ````
Step 3: Configure Redis
````
Начало примечание
````
**Note**
For the password, the following characters are allowed:
- Uppercase Latin letters: A to Z
- Lowercase Latin letters: a to z
- Digits: 0 to 9
- Symbols: -\_
Reserved (invalid) symbols:
\! \* ' ( ) ; : @ \& = + \$ , / ? % # \[ \]
````
конец примечание
````
To configure, edit the \[OBJECT\] file on each server:
````
sudo nano /etc/redis/redis.conf
1. ````
Make the servers accessible from all IP addresses of this server. This makes the Redis service accessible from all external addresses:
````
bind 0.0.0.0
2. ````
Increase the maximum number of clients by changing the value of the parameter \[OBJECT\] to \[OBJECT\]. Uncomment the line by removing the hash sign #:
````
maxclients 20000
3. ````
Set the key eviction policy by changing the value of the \[OBJECT\] parameter to \[OBJECT\]. Uncomment the line by removing the hash sign #:
````
maxmemory-policy allkeys-lfu
4. ````
Disable **snapshot** creation by changing the value of the \[OBJECT\] parameter to \[OBJECT\]. Uncomment the line by removing the hash sign #:
````
save ""
5. ````
Disable AOF (Redis database saving to file). To do this, replace the value of the \[OBJECT\] parameter with \[OBJECT\]. Uncomment the line by removing the hash sign #:
````
appendonly no
6. ````
Specify the password to the master:
````
masterauth SecretPassword
7. ````
Specify the domain (FQDN) to represent the node in the cluster:
- on the node \[OBJECT\]:
````
replica-announce-ip redis-server1.your\_domain
- ````
on the node \[OBJECT\]:
````
replica-announce-ip redis-server2.your\_domain
- ````
on the node \[OBJECT\]:
````
replica-announce-ip redis-server3.your\_domain
8. ````
Specify the password for access:
````
requirepass SecretPassword
9. ````
On nodes \[OBJECT\] and** **\[OBJECT\], specify the domain (FQDN) and port to connect to the master node (\[OBJECT\]):
````
replicaof redis-server1.your\_domain 6379
10. ````
Restart all servers (primary the master, then subordinates):
````
sudo systemctl restart redis-server
sudo systemctl enable redis-server
11. ````
Check the replication status on the node \[OBJECT\]:
````
sudo redis-cli -a SecretPassword info replication
````
If no errors occurred, the configuration was successful.
Enabling TLS/SSL in Redis
To enable TLS/SSL support in Redis, you need to edit the configuration file \[OBJECT\]:
1. Disable unsecured connections by setting \[OBJECT\] in the parameter \[OBJECT\].
2. Set the port for TLS connections, uncomment the parameter \[OBJECT\].
3. In the parameter \[OBJECT\], specify the path to the server certificate file.
4. In the parameter \[OBJECT\], specify the path to the private key file.
5. In the parameter \[OBJECT\], specify the path to the root CA file.
````
port 0
tls-port 6379
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
tls-ca-cert-file /path/to/ca.crt
6. ````
Restart all servers (primary the master, then subordinates):
````
sudo systemctl restart redis-server
sudo systemctl enable redis-server
7. ````
Check the replication status on the node \[OBJECT\]:
````
sudo redis-cli -p 6379 -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key -a SecretPassword info replication
````
For more details on configuring TLS/SSL in Redis, refer to the [official Redis documentation](https://redis.io/docs/management/security/encryption/).
## Step 4: Configure Sentinel
To configure Sentinel, edit the file \[OBJECT\] on each server.
````
Начало внимание````
To work correctly, observe the specified order of entries in the file \[OBJECT\].
````
Конец внимание
1. ````
Make the servers accessible from all IP addresses of this server. In this case, it makes the Sentinel service accessible from all external addresses:
````
bind 0.0.0.0
2. ````
Specify the domain (FQDN) to represent Sentinel nodes:
- on the node \[OBJECT\]:
````
sentinel announce-ip redis-server1.your\_domain
- ````
on the node** **\[OBJECT\]:
````
sentinel announce-ip redis-server2.your\_domain
- ````
on the node \[OBJECT\]:
````
sentinel announce-ip redis-server3.your\_domain
3. ````
Specify the domain (FQDN) and port of the master, as well as the value to achieve the quorum:
````
sentinel monitor mymaster redis-server1.your\_domain 6379 2
4. ````
Specify the password for access to the master:
````
sentinel auth-pass mymaster SecretPassword
5. ````
Specify the time after which the master will be considered down:
````
sentinel down-after-milliseconds mymaster 3000
6. ````
Specify the waiting time after the Subordinate switches roles to master in case the master goes down:
````
sentinel failover-timeout mymaster 6000
7. ````
Enable support for resolving hostnames:
````
sentinel resolve-hostnames yes
sentinel announce-hostnames yes
8. ````
To increase security, configure the **default** user to access Sentinel by password only:
````
user default on >SecretPassword sanitize-payload ~\* \&\* +@all
9. ````
After that, restart all servers:
````
sudo systemctl restart redis-sentinel
sudo systemctl enable redis-sentinel
10. ````
Check the Sentinel status and the quorum state on the node **redis-server1.your\_domain **using different commands depending on the TLS/SSL usage and Sentinel configuration:
- Without TLS/SSL if password access to Sentinel is not enabled:
````
sudo redis-cli -p 26379 info sentinel
sudo redis-cli -p 26379 sentinel ckquorum mymaster
- ````
Without TLS/SSL if password-only access to Sentinel is set up:
````
sudo redis-cli -p 26379 -a SecretPassword info sentinel
sudo redis-cli -p 26379 -a SecretPassword sentinel ckquorum mymaster
- ````
With TLS/SSL if password access to Sentinel is not enabled:
````
sudo redis-cli -p 26379 -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key info sentinel
sudo redis-cli -p 26379 -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key sentinel ckquorum mymaster
- ````
With TLS/SSL if password-only access to Sentinel is set up:
````
sudo redis-cli -p 26379 -a SecretPassword -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key info sentinel
sudo redis-cli -p 26379 -a SecretPassword -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key sentinel ckquorum mymaster
````
Enabling TLS/SSL in Sentinel
To enable TLS/SSL support in Sentinel, edit the configuration file \[OBJECT\]:
1. Disable unsecured connections by setting \[OBJECT\] in the parameter \[OBJECT\].
2. Set the port for TLS connections, add the parameter \[OBJECT\].
3. Add the parameter \[OBJECT\] and specify the path to the server certificate file.
4. Add the parameter \[OBJECT\] and specify the path to the private key file.
5. Add the parameter \[OBJECT\] and specify the path to the root CA file.
6. Add the parameter \[OBJECT\] enabling TLS support, specifying the value \[OBJECT\].
````
port 0
tls-port 26379
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
tls-ca-cert-file /path/to/ca.crt
tls-replication yes
7. ````
After that, restart all servers:
````
sudo systemctl restart redis-sentinel
sudo systemctl enable redis-sentinel
8. ````
Check the Sentinel status and the quorum state on the node \[OBJECT\]:
````
sudo redis-cli -p 26379 -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key info sentinel
sudo redis-cli -p 26379 -h redis-server1.your\_domain --tls --cacert /path/to/ca.crt --cert /path/to/redis.crt --key /path/to/redis.key sentinel ckquorum mymaster
````
For more details on configuring TLS/SSL in Sentinel, refer to the [official Redis documentation](https://redis.io/docs/management/security/encryption/#sentinel).
## Step 5: Connect to Redis
Connect to Redis. The connection string depends on the use of TLS/SSL and Sentinel configuration:
- Without TLS/SSL if password access to Sentinel is not enabled:
````
redis://:SecretPassword@redis-server1.your\_domain:26379,redis-server2.your\_domain:26379,redis-server3.your\_domain:26379/0?masterName=mymaster
- ````
Without TLS/SSL if password-only access to Sentinel is set up:
````
redis://:SecretPassword@redis-server1.your\_domain:26379,redis-server2.your\_domain:26379,redis-server3.your\_domain:26379/0?masterName=mymaster\&sentinelUsername=default\&sentinelPassword=SecretPassword
- ````
With TLS/SSL if password access to Sentinel is not enabled:
````
redis://:SecretPassword@redis-server1.your\_domain:26379,redis-server2.your\_domain:26379,redis-server3.your\_domain:26379/0?masterName=mymaster
- ````
With TLS/SSL if password-only access to Sentinel is set up:
````
rediss://:SecretPassword@redis-server1.your\_domain:26379,redis-server2.your\_domain:26379,redis-server3.your\_domain:26379/0?masterName=mymaster\&sentinelUsername=default\&sentinelPassword=SecretPassword
````