0xfurai / 0xfurai/peekaping

Support Redis ACL username authentication

Đang mở
#279 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Go
Star
1.2k
Fork
69
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

**Is your feature request related to a problem? Please describe.**

Peekaping currently supports Redis authentication via password-only configuration, but it does not appear to support Redis ACL usernames.

This is a problem when deploying Peekaping to a shared Redis 6+ / Redis 8+ instance where each application uses a dedicated ACL user. In that setup, Redis requires authentication as `AUTH `. If Peekaping only sends `AUTH `, Redis treats it as the `default` user and returns:

```text
WRONGPASS invalid username-password pair or user is disabled.
```

This prevents Peekaping from using a shared Redis service with per-application ACL isolation.

**Describe the solution you'd like**

Please add support for configuring a Redis ACL username, for example:

```env
REDIS_USERNAME=peekaping
REDIS_PASSWORD=...
REDIS_HOST=...
REDIS_PORT=6379
REDIS_DB=0
```

The Redis client configuration should pass both username and password when `REDIS_USERNAME` is set, while preserving current password-only behavior when it is omitted.

This should apply consistently to all Redis usage in Peekaping, including queue/Asynq clients and Redis pub/sub/event bus clients.

**Describe alternatives you've considered**

The current workaround is to give Peekaping the password for Redis' `default` user, but that weakens isolation in shared Redis deployments and makes per-application ACLs ineffective.

Another workaround is deploying a dedicated Redis instance only for Peekaping, but that adds operational overhead and duplicates infrastructure that already exists in clusters with shared Redis.

**Additional context**

Deployment environment:

- Peekaping version: `0.0.46`
- Redis: shared Redis HA / Redis 8.x with ACL users enabled
- Kubernetes deployment with external PostgreSQL and Redis
- Redis endpoint is exposed through HAProxy
- Desired ACL entry pattern:

```text
user peekaping on >... ~* &* +@all
```

Observed logs from Peekaping components:

```text
WRONGPASS invalid username-password pair or user is disabled.
```

The same password works when authenticating as the dedicated ACL user, but Peekaping cannot currently provide that username to Redis.

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Hướng nghiên cứu

Look for Redis client configuration in the codebase, likely in files handling queue/Asynq and pub/sub clients. Search for environment variable usage like REDIS_PASSWORD. The change involves modifying the authentication command to optionally include a username when REDIS_USERNAME is set. Test by connecting to a Redis instance with ACL enabled to verify the new AUTH format works.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
go, redis
Lĩnh vực
authentication, backend
Loại issue
Tính năng
Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức độ hoạt động
Ít trao đổi
Độ rõ ràng
Đặc tả rõ ràng
Mức phù hợp với người mới
65/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.