Set up a Redis cache and connect over TLS

A managed Redis is the quickest cache or session store you can add to an application: order it, copy the connection string, point your framework at it. Ours is reachable over TLS with a publicly trusted certificate, so your client verifies the server like it verifies a website. This guide orders one and connects from redis-cli, Node and Python.

What you need

• A Headpat Space account with a verified email address and your billing details filled in.
• Any Redis client that supports TLS. All current ones do.

1. Order Redis

1. Sign in to the panel, open Apps in the sidebar and click Create App.
2. Under Template, search for Redis and select it.
3. Under Package, pick cache or persistent. A cache keeps everything in memory only; a restart empties it, which is fine for sessions and cached pages. Persistent writes an append-only log to disk and comes back with its data after a restart; choose it for queues, counters or anything you would miss.
4. Fill in a Display name, pick a version if you need a specific one, tick the box confirming that provisioning may start right away, click Deploy app and complete the payment.

The instance is ready within a minute. Wait until the app page shows it as running.

2. Find your connection details

Open the app under Apps. The card Database Connection shows Host and Port. The port is one of its own, not 6379, and the hostname is unique to your instance. Click Reveal next to Credentials to see the Password and the Connection string:

rediss://:YOUR_PASSWORD@YOUR_HOST:YOUR_PORT/0

Note the double s in rediss://: it tells the client to use TLS. Every field has a copy button. Treat the password like any other secret.

3. Connect with redis-cli

redis-cli --tls --sni YOUR_HOST -h YOUR_HOST -p YOUR_PORT -a YOUR_PASSWORD

--sni matters: the certificate is selected by the hostname the client announces, and redis-cli does not announce one unless told to. Without it the handshake fails with a certificate error. Most other clients send the hostname by default.

redis-cli uses your operating system's trusted certificate authorities. On a minimal Linux image without them, point it at the bundle explicitly with --cacert /etc/ssl/certs/ca-certificates.crt. You should see the prompt; PING answers PONG.

4. Connect from your application

Most libraries take the connection string as is, usually from an environment variable:

REDIS_URL=rediss://:YOUR_PASSWORD@YOUR_HOST:YOUR_PORT/0

Node with ioredis:

import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
await redis.set("greeting", "hello");
console.log(await redis.get("greeting"));

Python with redis-py:

import os
import redis

r = redis.from_url(os.environ["REDIS_URL"])
r.set("greeting", "hello")
print(r.get("greeting"))

Both verify the server certificate against the system's trusted roots and check the hostname. Nothing to download, no flag to disable verification. If an older library asks for a CA file, give it your operating system's bundle; the certificate chains to a public root.

Limit who can connect

By default the instance accepts connections from any address that knows the password. On the app page, the card IP Allowlist narrows that to the addresses you list, for example your application server's IP. Add the address, click Save, and the card shows Restricted.

Look inside

The Database console card on the app page has a Keys tab that lists keys by pattern with their type and time to live, and a Commands tab that runs any Redis command. Handy to confirm your application is writing what you expect; see Browse and query your database from the panel.

Good to know

• The certificate is issued by Let's Encrypt and renewed automatically; connections are not interrupted by a renewal.
• Redis has no users, only the one password. Rotating it means a new instance for now; keep the password out of repositories and screenshots.
• Memory is the resource that matters. The CPU & memory card shows how close you are to the limit. Redis is not told to evict keys on its own; if it outgrows the package, it is restarted and a cache package starts empty. Expire keys you do not need forever, and upgrade before the line is flat at the top.
• Backups follow the package: a persistent instance is snapshotted on the schedule shown in the Backups card, a cache has nothing worth backing up.