Authentication

Postgres-backed Redis AUTH — secure by default, optional open mode.

PostRESP separates how the gateway reaches Postgres from whether Redis clients must authenticate on the wire.

Secure default (shipped image)

With RequireClientAuth: true (default), a new RESP connection is unauthenticated. Until the client succeeds at AUTH or HELLO … AUTH, other commands return:

-NOAUTH Authentication required.

Credentials are verified by opening a real Postgres session as that LOGIN role. Success replaces the connection’s SQL session with that role; failure returns WRONGPASS invalid username-password pair.

redis-cli -p 6379 -a redis PING
# or
redis-cli -p 6379
AUTH redis redis
PING

URL form:

REDIS_URL=redis://redis:redis@127.0.0.1:6379

AUTH password (one argument) uses the configured default user (PostgresSystemUser / USERNAME). AUTH user password uses that Postgres role.

Set credentials at container create so the Postgres role and gateway config match (USERNAME / PASSWORD alongside POSTGRES_USER / POSTGRES_PASSWORD). Changing them later does not rewrite an existing data directory.

Open mode (opt out)

For local experiments or harnesses that expect Redis without a password (including make compat, which restarts the stack with this flag):

REQUIRE_CLIENT_AUTH=false
# or in SetupConfiguration.json: "RequireClientAuth": false

Clients may omit Redis AUTH. The gateway still connects to Postgres as USERNAME / PASSWORD. Optional AUTH / HELLO … AUTH still works and switches the session to the authenticated role.

RESET

RESET clears subscription state, client name, and authentication (Redis-like). With client auth required, the connection must AUTH again before other commands. With open mode, the gateway restores the system Postgres session.

Spring Data Redis / Lettuce

RedisStandaloneConfiguration standalone = new RedisStandaloneConfiguration();
standalone.setHostName("127.0.0.1");
standalone.setPort(6379);
standalone.setUsername("redis");
standalone.setPassword("redis");

Point every app instance at the same RESP endpoint. Pub/Sub fan-out is process-local to that gateway. HELLO 3 is refused with NOPROTO so Lettuce falls back to RESP2.

Not implemented

• Redis ACL command family (ACL SETUSER, channel permissions, …)
• Redis requirepass as a separate credential store (identity is Postgres)
• Sentinel / Cluster auth APIs