Valkey With A Password, A Limit And A Log
Valkey, the Redis successor EL 10 ships in place of a redis package that no longer exists. The package sets no password, no maxmemory and no append-only log; this role sets all three, on loopback, with the drop-in given the last word over the package configuration. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-19 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-valkey-server?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Valkey With A Password, A Limit And A Log](https://www.iac-bazaar.com/catalog/ansible-valkey-server?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Valkey With A Password, A Limit And A Log: https://www.iac-bazaar.com/catalog/ansible-valkey-server (download from your IaC Bazaar account)
```Preview:
Documentation
valkey-server
Valkey - the Redis successor Enterprise Linux 10 ships in place of Redis - on loopback, with a password, a memory limit and an append-only log. Original role for EL 10, live-tested with podman on Rocky Linux 10.
There is no redis package on EL 10. dnf install redis finds nothing;
valkey 8 is the drop-in, protocol-compatible and driven by valkey-cli. Any
playbook still installing redis on EL 10 fails at the first task.
The package sets no password, no memory limit, and no durability. Out of the
box any process on the host can read and flush every key; maxmemory is unset,
so the dataset grows until the kernel kills something; and appendonly is off,
so a restart loses everything written since the last snapshot. This role sets
requirepass, a maxmemory with noeviction (writes fail at the limit rather
than keys quietly vanishing - switch to allkeys-lru for a pure cache), and
turns the append-only log on with everysec fsync.
The drop-in has the last word. Valkey applies directives in order and later ones win, so the role includes its file from the END of the package configuration rather than editing it line by line. The drop-in holds the password and is readable by the service account only.
The password placeholder is refused when you ask. Set
valkey_server_refuse_placeholder_password: true in any real inventory and the
role stops before writing the placeholder into the configuration.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-clickhouse
ClickHouse on EL 10 from the upstream LTS release (sha512-verified), as a hardened systemd service on loopback with the default user behind a password; the live test creates a MergeTree table, inserts a row and selects it back over HTTP; a query without credentials is refused. Original role, live-tested on Rocky Linux 10.
ansible-dragonfly
Dragonfly on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback behind a password kept in a flagfile; the live test speaks RESP itself: an unauthenticated PING and a wrong password are refused, AUTH + SET + GET round-trip. Original role, live-tested on Rocky Linux 10.
ansible-influxdb3
InfluxDB 3 Core on EL 10 from the vendor's release (checksum-verified), as a hardened systemd service on loopback with file object storage; the binary runs from its release directory (it links the Python it ships); the live test writes a point in line protocol and reads it back with SQL. Original role, live-tested on Rocky Linux 10.
ansible-mariadb-server
MariaDB bound to loopback (the package listens everywhere), with the mariadb-secure-installation steps applied by the role: anonymous users, the test database and remote root gone, LOAD DATA LOCAL off, reverse DNS off. Provisions an application database and a user that can see nothing else. Original role, live-tested on Rocky Linux 10.
ansible-meilisearch
Meilisearch on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback in production mode behind a master key; the live test creates an index and documents, waits for the indexing task, searches and finds the one match, and sees a keyless request refused. Original role, live-tested on Rocky Linux 10.
ansible-mongodb
MongoDB Community 8.0 from MongoDB's repository, its key pinned by fingerprint: authorization on from the first start, the first administrator made through the localhost exception with a generated password, SCRAM-SHA-256 only, loopback. The live test writes as the administrator and is refused anonymously, with a wrong password and over SCRAM-SHA-1. Original role, live-tested on Rocky Linux 10.