Bound to every interface
The one that turns a data leak into remote code execution. CONFIG SET dir plus SAVE writes a file anywhere Redis can write, so an exposed port with no password is enough.
- role
- cache
- bind
- 0.0.0.0
- maxmemory
- 4gb
Redis Config File Generator
Describe the instance and get a redis.conf with a comment above every directive saying why it has that value. Nothing here writes a password into the file, deliberately: a generated credential outlives every rotation policy.
redis.conf
updates as you typeExamples
Worked setups you can load into the form above. Each one is a decision the generator makes differently, and the reason it makes it.
A cache that refuses writes
noeviction on a cache, which is the Redis default and so arrives by omission rather than by choice. Reads keep working while every write fails with OOM.
- role
- cache
- maxmemory-policy
- noeviction
- maxmemory
- 2gb
A datastore with no AOF
Snapshots alone lose every write since the last one. That is correct for a cache and is data loss for anything else.
- role
- datastore
- appendonly
- no
- maxmemory
- 8gb
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Setting maxmemory to the size of the machine
Replication buffers, client buffers and the fork during a save all live outside that limit, so resident memory goes above it and the kernel kills the process.
Instead:Leave 30 to 40 percent free.
Leaving maxmemory-policy at the default on a cache
The default is noeviction. Writes start failing at the limit while reads keep working, so the instance looks healthy and stops caching anything new.
Instead:Set allkeys-lru or allkeys-lfu explicitly.
Putting requirepass in the file and committing it
The credential is then in the repository history, and it outlives every rotation. Removing the line later does not remove it from history.
Instead:Inject it at runtime from a secret store.
Assuming CONFIG SET changes survive a restart
CONFIG SET applies immediately and is lost on restart unless CONFIG REWRITE is run. A setting fixed during an incident quietly reverts.
Instead:Run CONFIG REWRITE, or change the file and restart.
Four defaults that are not what you want
A stock redis.conf is tuned for starting up on a laptop, not for the job you are giving it. These four are the ones that cause incidents.
maxmemory is unlimited by default
With no limit Redis grows until the machine runs out and the kernel kills it. There is no warning stage: the process disappears. Setting a limit turns an OOM kill into an eviction, which is a policy decision rather than an outage.
noeviction is the default policy
It arrives by omission rather than by choice, and on a cache it is wrong. At the limit, reads keep working while every write fails with an OOM error, so the cache stops accepting new entries and quietly stops being useful while looking healthy.
A datastore with no AOF loses writes on restart
RDB snapshots are point in time, so everything written since the last one is gone. If the data can be rebuilt from somewhere else that is fine. If it cannot, it is data loss on an ordinary restart.
The memory limit is not the machine size
Replication buffers, client output buffers and the copy-on-write of a background save all sit outside maxmemory. An instance set to the full machine size is reliably OOM killed during a save, which is the moment it is doing the most work.
What this cannot know
It cannot see your workload, your key sizes or your network. The numbers here are a defensible starting point with the reasoning attached, not a measurement. Check maxmemory against real usage once the instance has run under load.
More redis tools
Redis Hash Slot Calculator Which of the 16,384 slots does this key land in? Redis Hash Tag Tester Will these keys survive a multi-key command? Redis RESP Protocol Decoder Read what the server actually sent Redis RESP2 vs RESP3 Reply Decoder What the same reply looks like on each protocol Redis Command to RESP Exactly what your client puts on the socket Redis Glob Pattern Tester Redis globs are not shell globs Redis Connection URL Parser The path is the database number Redis Memory Unit Converter 1g and 1gb are not the same number Redis TTL Converter -1 and -2 are not durations Redis Stream ID Parser The first half is a millisecond timestamp redis.conf Validator Will Redis start with this file? Redis Production Config Linter The settings that cause incidents redis.conf to CONFIG SET Which of these can you change without a restart? Redis ACL Rule Decoder What does this user actually get? Redis ACL Validator Find the rule that does nothing Redis INFO Analyzer The numbers INFO does not print Redis SLOWLOG Analyzer What blocked everyone else Redis CLUSTER NODES Parser Read the topology, and find the gap Redis Cluster Slot Distribution Who owns how much, and what is missing Redis Keyspace Notification Flags Why your events never arrive Redis Memory Calculator The encoding decides, not the data Redis Key Count to Memory The fixed cost per key Redis Encoding Threshold Calculator One field more, several times the memory Redis Bitmap Memory Calculator Sized by the highest bit, not the set ones Redis HyperLogLog Calculator 12 KB whether you count a thousand or a billion Redis Cluster Sizing Only 60% of each node is usable Redis RDB and AOF Size Calculator The fork needs memory, not disk Redis Replication Bandwidth Calculator How long the backlog actually covers Redis Connection Pool Calculator More connections is not more throughput Redis Pipeline Calculator It removes round trips, not work Redis Cache Hit Rate Calculator 99% to 90% is ten times the backend load Redis Eviction Policy Simulator volatile- with no TTLs is noeviction Redis Cost Estimator Your rates, so nothing goes stale Redis ACL Generator A user that can do exactly one job Redis Maxmemory Config Generator The limit, and the headroom it needs Redis Persistence Config Generator How much you can afford to lose Redis Lua Script Generator Atomic, and short enough to stay that way Redis TLS Config Generator Encrypted, and the old port actually closed Redis Sentinel Config Generator Failover that can actually be authorised Redis Cluster Config Generator Three primaries, and the bus port open Redis Docker Compose Generator Local Redis that is not on the internet Redis Client Config Generator Timeouts on both sides, and a sane pool Redis MEMORY STATS Analyzer Which number actually matters Redis Bigkeys Output Analyzer Elements are not bytes Redis CLIENT LIST Analyzer Find the connection hurting you Redis LATENCY Report Analyzer An empty report may mean nothing was recorded Redis Keyspace Prefix Analyzer Which key family is growing Redis SET Command Builder A plain SET clears the TTL Redis ZRANGE Query Builder REV reverses the argument order Redis SCAN Iteration Planner COUNT is a hint, not a page size Redis Key Name Validator Legal is not the same as workable Redis Cluster Compatibility Checker Works now, breaks when you shard