Managed Redis on Cloider

View as Markdown Open in Claude Open in ChatGPT

Cloider runs managed Redis 8, the in-memory key-value store used for caching, sessions, rate limiting, job queues, leaderboards and pub/sub. Each Redis database is its own server with its own memory and storage, an ACL user created for you, backups with point-in-time restore and optional TLS.

At a glance


Version	Redis 8
Topology	A standalone server (no replicas, no cluster mode)
Port	Assigned per database (not 6379)
User	An ACL user you chose (for example `cache_user`) with access to all keys, channels and commands
Logical databases	16, numbered 0 to 15. Clients use database `0` by default
SSL	Off by default. When on, the server accepts only TLS connections
Client	`redis-cli`
Plans	Hobby (0.25 vCPU, 0.25 GB RAM, 1 GB storage) to Pro (2 vCPU, 8 GB RAM, 32 GB storage), see plans
Backups	A full backup every 14 days plus every change recorded, restored into a new database as of now or any second of the last 14 days

Create a Redis database

cloider db create cache --engine redis --plan starter --wait

Or in the dashboard, choose Redis v8 under Database Engine. SSL Mode starts off for Redis; turn it on if clients connect over the internet. See create a database.

Connection details

Detail	Example
Public host	`cache-c5n1qa.db.cloider.com`
Private host (Cloider apps and clusters)	`cache-c5n1qa.db.cloider.internal`
Port	`26742`
User	`cache_user`
Password	`cloider db password cache`
Database number	`0` (0 to 15 available)

The connection string:

# SSL off
redis://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0

# SSL on (TLS only)
rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0

Always send the user name

Authenticate as your user, with both the user name and the password: AUTH cache_user PASSWORD, or cache_user:PASSWORD@ in a URL. A password alone (AUTH PASSWORD, or redis://:PASSWORD@...) logs in as Redis's default user, which has a different password reserved for Cloider, and fails with WRONGPASS.

Connect with redis-cli

With SSL off (the default for Redis):

REDISCLI_AUTH="$(cloider db password cache)" \
  redis-cli -h cache-c5n1qa.db.cloider.com -p 26742 --user cache_user

With SSL on, add --tls and the CA certificate:

cloider db cert cache -f ca.crt
REDISCLI_AUTH="$(cloider db password cache)" \
  redis-cli -h cache-c5n1qa.db.cloider.com -p 26742 --user cache_user --tls --cacert ca.crt

REDISCLI_AUTH keeps the password out of your shell history and the process list. The CLI can do all of this for you, or run redis-cli inside Cloider without anything installed:

cloider db connect cache                      # runs redis-cli with the right flags
cloider db shell cache                        # interactive redis-cli, nothing to install
cloider db exec cache SET greeting "hello"    # one command
cloider db exec cache GET greeting

Output
"hello"

Connect from code

From a Cloider app or cluster, use the private host, see connect from a Cloider app or cluster. The examples use rediss:// with the CA certificate from cloider db cert cache -f ca.crt. With SSL off, use redis:// and drop the TLS options.

With ioredis (npm install ioredis):

redis.js
import fs from "node:fs";
import Redis from "ioredis";

// rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0
const redis = new Redis(process.env.REDIS_URL, {
  tls: { ca: fs.readFileSync("ca.crt") },
});

await redis.set("session:9f2c", JSON.stringify({ userId: 42 }), "EX", 3600);
console.log(await redis.get("session:9f2c"));

With node-redis (npm install redis):

redis.js
import fs from "node:fs";
import { createClient } from "redis";

const client = createClient({
  url: process.env.REDIS_URL,
  socket: { tls: true, ca: fs.readFileSync("ca.crt") },
});
client.on("error", (err) => console.error(err));
await client.connect();

await client.set("greeting", "hello", { EX: 60 });
console.log(await client.get("greeting"));

With redis-py (pip install redis):

cache.py
import os
import redis

# rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0
r = redis.Redis.from_url(os.environ["REDIS_URL"], ssl_ca_certs="ca.crt", decode_responses=True)

r.set("greeting", "hello", ex=60)
print(r.get("greeting"))

With go-redis (go get github.com/redis/go-redis/v9):

main.go
package main

import (
	"context"
	"crypto/x509"
	"fmt"
	"os"
	"time"

	"github.com/redis/go-redis/v9"
)

func main() {
	ctx := context.Background()

	// rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0
	opt, err := redis.ParseURL(os.Getenv("REDIS_URL"))
	if err != nil {
		panic(err)
	}

	// rediss:// turns TLS on, add Cloider's CA to it
	pem, err := os.ReadFile("ca.crt")
	if err != nil {
		panic(err)
	}
	roots := x509.NewCertPool()
	roots.AppendCertsFromPEM(pem)
	opt.TLSConfig.RootCAs = roots

	rdb := redis.NewClient(opt)
	if err := rdb.Set(ctx, "greeting", "hello", time.Minute).Err(); err != nil {
		panic(err)
	}
	fmt.Println(rdb.Get(ctx, "greeting").Val())
}

With Predis (composer require predis/predis):

cache.php
<?php
require 'vendor/autoload.php';

$redis = new Predis\Client([
    'scheme'   => 'tls',
    'host'     => 'cache-c5n1qa.db.cloider.com',
    'port'     => 26742,
    'username' => 'cache_user',
    'password' => getenv('REDIS_PASSWORD'),
    'ssl'      => ['cafile' => __DIR__ . '/ca.crt', 'verify_peer' => true],
]);

$redis->set('greeting', 'hello', 'EX', 60);
echo $redis->get('greeting');

With SSL off, use 'scheme' => 'tcp' and drop ssl.

With Lettuce:

Main.java
import io.lettuce.core.*;
import io.lettuce.core.api.sync.RedisCommands;
import java.io.File;

public class Main {
    public static void main(String[] args) {
        // rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0
        RedisClient client = RedisClient.create(RedisURI.create(System.getenv("REDIS_URL")));
        client.setOptions(ClientOptions.builder()
                .sslOptions(SslOptions.builder().trustManager(new File("ca.crt")).build())
                .build());

        try (var connection = client.connect()) {
            RedisCommands<String, String> redis = connection.sync();
            redis.setex("greeting", 60, "hello");
            System.out.println(redis.get("greeting"));
        }
        client.shutdown();
    }
}

With the redis gem (gem install redis):

cache.rb
require "redis"

# rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0
redis = Redis.new(url: ENV.fetch("REDIS_URL"), ssl_params: { ca_file: "ca.crt" })

redis.set("greeting", "hello", ex: 60)
puts redis.get("greeting")

Use Redis with frameworks and job queues

BullMQ
Celery
Sidekiq
Laravel

queue.js
import fs from "node:fs";
import { Queue, Worker } from "bullmq";
import IORedis from "ioredis";

const connection = new IORedis(process.env.REDIS_URL, {
  maxRetriesPerRequest: null, // required by BullMQ workers
  tls: { ca: fs.readFileSync("ca.crt") },
});

const emails = new Queue("emails", { connection });
await emails.add("welcome", { to: "ada@example.com" });

new Worker("emails", async (job) => console.log("sending", job.data), { connection });

celery_app.py
import os
import ssl
from celery import Celery

app = Celery("tasks", broker=os.environ["REDIS_URL"], backend=os.environ["REDIS_URL"])

# Needed for rediss:// URLs
tls = {"ssl_cert_reqs": ssl.CERT_REQUIRED, "ssl_ca_certs": "ca.crt"}
app.conf.broker_use_ssl = tls
app.conf.redis_backend_use_ssl = tls

config/initializers/sidekiq.rb
redis = { url: ENV.fetch("REDIS_URL"), ssl_params: { ca_file: "ca.crt" } }

Sidekiq.configure_server { |config| config.redis = redis }
Sidekiq.configure_client { |config| config.redis = redis }

For a Laravel app running on Cloider, connect over the private host with SSL off:

.env
REDIS_CLIENT=phpredis
REDIS_HOST=cache-c5n1qa.db.cloider.internal
REDIS_PORT=26742
REDIS_USERNAME=cache_user
REDIS_PASSWORD=PASSWORD

CACHE_STORE=redis
SESSION_DRIVER=redis
QUEUE_CONNECTION=redis

REDIS_USERNAME is required, see always send the user name.

Redis features and limits on Cloider

Your user and the default user

Your database comes with one ACL user, the one you chose when creating it, with access to every key (~*), every pub/sub channel (&*) and every command (+@all). Redis's built-in default user exists too, with a separate password that Cloider keeps for itself. Check who you are with:

ACL WHOAMI

Changes made with ACL and CONFIG don't survive a restart

Users you add with ACL SETUSER and settings you change with CONFIG SET take effect immediately, but they are lost when the server restarts, for example after a resize, an SSL change or a resume. Re-apply them from your application at startup if you depend on them.

Memory is the limit

Redis keeps the whole dataset in RAM, so the plan's RAM is the size of your data plus Redis's own overhead. Watch Memory in Insights or with INFO memory, give cache keys an expiry (SET key value EX 3600), and resize before memory runs out.

INFO memory
MEMORY USAGE session:9f2c
DBSIZE

TLS only when SSL is on

Turning SSL on makes Redis serve TLS on its port and stop accepting plain connections. Every client then needs rediss:// (or its TLS option) and the CA certificate. Turning it off does the reverse. Change both at the same time to avoid downtime, see SSL/TLS.

Logical databases

Redis has 16 logical databases, 0 to 15, selected with SELECT 1 or /1 at the end of the URL. They share the server's memory and are all included in backups. Separate apps are better kept in separate Cloider databases, so one can't fill the other's memory.

Single server

A Redis database on Cloider is one server without replicas, Sentinel or cluster mode. Use a plain (non-cluster, non-Sentinel) client configuration, and let your client reconnect after restarts.

Backups and restore

Cloider takes a full backup of every Redis database every 14 days and records every change in between from its append-only file (AOF). A restore creates a new database with your data as it is now, or as it was at any second of the last 14 days, for example right before a bad FLUSHALL. It brings back the whole server: all 16 logical databases, every key and its expiry time.

Redis persists with the AOF, written to disk every second, instead of periodic RDB snapshots, so a restart loses at most about a second of writes.

Troubleshooting

Error	Cause and fix
`Could not connect to Redis at ...: Connection timed out`	Your IP isn't trusted. `cloider db trusted-sources cache --add-my-ip`
`WRONGPASS invalid username-password pair or user is disabled.`	The user name is missing (password only logs in as `default`), or the password is wrong. Send `cache_user` and its password
`Error: Connection reset by peer` or `Error: Server closed the connection`	SSL is on, so the server only speaks TLS, and the client connected without it. Use `rediss://` or `--tls`
`SSL_connect failed` or `certificate verify failed`	The client doesn't trust Cloider's CA. Pass `--cacert ca.crt` or your client's CA option
`Protocol error` with SSL off	The client uses TLS (`rediss://`) but SSL is off. Use `redis://`
`MOVED` or `CLUSTERDOWN` errors, or the client waits for Sentinel	The client is configured for cluster or Sentinel mode. Use a single-node configuration

Next steps

Frequently asked questions

Which Redis version does Cloider run?

Cloider runs Redis 8 as a standalone server, one per database.

Why do I get WRONGPASS when connecting to Cloider Redis?

Redis needs your user name as well as the password. Use AUTH cache_user PASSWORD or a URL like redis://cache_user:PASSWORD@host:port/0. A password alone logs in as the default user, whose password is reserved for Cloider.

Is SSL on by default for Redis?

No. Redis databases start with SSL off, because turning SSL on makes Redis accept only TLS connections. Turn it on in the Settings tab or with cloider db ssl <database> on, then switch clients to rediss://.

What port does Cloider Redis use?

Each Redis database gets its own port when it is created, not 6379. The port is in the connection details.

How much data can I store in Cloider Redis?

As much as fits in the plan's RAM, from 0.25 GB on Hobby to 8 GB on Pro. Resize to a larger plan when memory runs out.

Does Cloider Redis support Redis Cluster or Sentinel?

No. Each Redis database is a single standalone server. Configure your client for a single node.

At a glance​

Create a Redis database​

Connection details​

Connect with redis-cli​

Connect from code​

Use Redis with frameworks and job queues​

Redis features and limits on Cloider​

Your user and the default user​

Changes made with ACL and CONFIG don't survive a restart​

Memory is the limit​

TLS only when SSL is on​

Logical databases​

Single server​

Backups and restore​

Troubleshooting​

Next steps​