Valkey With A Password, A Limit And A Log

valkey-server

Valkey - the Redis successor Enterprise Linux 10 ships in place of Redis - on loopback, with a password, a memory limit and an append-only log. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no redis package on EL 10. dnf install redis finds nothing; valkey 8 is the drop-in, protocol-compatible and driven by valkey-cli. Any playbook still installing redis on EL 10 fails at the first task.

The package sets no password, no memory limit, and no durability. Out of the box any process on the host can read and flush every key; maxmemory is unset, so the dataset grows until the kernel kills something; and appendonly is off, so a restart loses everything written since the last snapshot. This role sets requirepass, a maxmemory with noeviction (writes fail at the limit rather than keys quietly vanishing - switch to allkeys-lru for a pure cache), and turns the append-only log on with everysec fsync.

The drop-in has the last word. Valkey applies directives in order and later ones win, so the role includes its file from the END of the package configuration rather than editing it line by line. The drop-in holds the password and is readable by the service account only.

The password placeholder is refused when you ask. Set valkey_server_refuse_placeholder_password: true in any real inventory and the role stops before writing the placeholder into the configuration.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.