Vivek Shukla - Selfhost

Setup Redis TLS With Self-signed Certificate

2025-09-08T00:00:00+00:00

This method is only recommended when connecting to redis server via local network.</p> </blockquote>

Generate Cert and Key file for self signed TLS, then move both these files to redis directory and set the proper permissions. Delete the Key file and copy the cert file to the client machine which will connect to the redis-server.</p>

cd</span> ~</span></span>
</span>
openssl</span> req</span> -x509 -nodes -days</span> 3650</span> -newkey</span> rsa:2048</span> \</span></span>
  -keyout</span> redis_tls.key</span> -out</span> redis_tls.crt</span> \</span></span>
  -subj</span> "/CN=YourOrg"</span></span>
</span>
sudo</span> cp redis_tls.key redis_tls.crt /etc/redis/</span> &&</span> rm</span> redis_tls.key</span></span>
sudo</span> chmod</span> 600</span> /etc/redis/redis_tls.key</span></span>
sudo</span> chmod</span> 644</span> /etc/redis/redis_tls.crt</span></span>
sudo</span> chown redis:redis /etc/redis/redis_tls.key</span></span>
sudo</span> chown redis:redis /etc/redis/redis_tls.crt</span></span></code></pre>🔗</a>Update Redis Configuration File</h2>
This command will append the value to redis.conf</code> (redis configuration file). Make sure to update the password.</p>
It will disable the non-tls support and enable the tls connection at port 6379</code> with previously generated key and cert files.</p>
sudo</span> tee</span> -a</span> /etc/redis/redis.conf</span> <<</span> EOF</span></span>
bind * -::*</span></span>
port 0</span></span>
tls-port 6379</span></span>
tls-cert-file /etc/redis/redis_tls.crt</span></span>
tls-key-file /etc/redis/redis_tls.key</span></span>
tls-auth-clients no</span></span>
tls-prefer-server-ciphers yes</span></span>
requirepass YOUR_PASSWORD_HERE</span></span>
EOF</span></span></code></pre>
Restart and enable redis</p>
sudo</span> systemctl restart redis-server</span></span>
sudo</span> systemctl enable redis-server</span></span></code></pre>
Check status with</p>
sudo</span> systemctl status redis-server</span></span></code></pre>
If any error then check journal (log)</p>
sudo</span> journalctl</span> -u</span> redis-server</span> -f</span></span></code></pre>🔗</a>Add Redis Certificate to Trusted CA Store in Client Machine</h2>
# Copy your certificate to CA certificates directory</span></span>
sudo</span> mv redis_tls.crt /usr/local/share/ca-certificates/redis_tls.crt</span></span>
</span>
# Update CA certificates</span></span>
sudo</span> update-ca-certificates</span></span></code></pre>🔗</a>Redis Connection URL</h2>
Since we want to connect to redis using TLS connection, so the protocol in the url will be rediss</code> (with double “ss”).</p>
rediss://:<your_password_here>@<redis_server_ip>:6379/0#insecure</span></span></code></pre>


Self Host PostgreSQL With TLS
2025-02-03T00:00:00+00:00
In this tutorial we will go through how to self-host PostgreSQL Database and setup TLS to securely connect.</p>
🔗</a>Installing PostgreSQL</h2>
Postgres APT repository configuration:</p>
sudo</span> apt install</span> -y</span> postgresql-common</span></span>
sudo</span> /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh</span></span></code></pre>
Install PostgreSQL 16</p>
sudo</span> apt install postgresql-16</span></span></code></pre>
After installing PostgreSQL, it creates a new user postgres</code>, which is the superuser of the database. We can switch to postgres</code> user in ubuntu to access postgresql command prompt:</p>
sudo</span> -i -u</span> postgres</span></span></code></pre>
Now to create new user with passowrd and with privilege to create new db. It will ask you to enter your password, which will not be logged into history hence this is the recommended way to set password.</p>
createuser</span> your_db_user</span> --pwprompt --createdb</span></span></code></pre>
Now we can exit from postgres</code> account</p>
exit</span></span></code></pre>
We will add new user in our Ubuntu with the same name as the new user we created in postgresql. (Optional) Add -m</code> to create home directory for the user.</p>
sudo</span> useradd</span> -s</span> /bin/bash your_db_user</span></span></code></pre>
Accessing psql as the new user we just created. Since we do not have any database associated with our user therefore we are using ‘-d postgres’ to use postgres db for now.</p>
sudo</span> -u</span> your_db_user psql</span> -U</span> your_db_user</span> -d</span> postgres</span></span></code></pre>
Create your database.</p>
CREATE</span> DATABASE your_db_name</span>;</span></span></code></pre>
This is how you can connect with your db if not already connected.</p>
\c</span> your_db_name</span>;</span></span></code></pre>🔗</a>Setting Up SSL</h2>
It’s important that we secure our communication with the database while accessing it remotely. We are going to setup SSL certificate using certbot</code> from LetsEncrypt.</p>
Install certbot</p>
sudo</span> snap install core</span>;</span> sudo</span> snap refresh core</span></span>
sudo</span> apt-get remove certbot</span></span>
sudo</span> snap install</span> --classic</span> certbot</span></span>
sudo</span> ln</span> -s</span> /snap/bin/certbot /usr/bin/certbot</span></span></code></pre>
Obtain certificate</p>
sudo</span> certbot certonly</span> --standalone -d</span> psql.example.com</span></span></code></pre>
Find PostgreSQL data directory</p>
sudo</span> -u</span> postgres psql</span> -U</span> postgres</span> -c</span> 'SHOW data_directory'</span></span></code></pre>
Create a renewal hook file</p>
sudo</span> nano /etc/letsencrypt/renewal-hooks/deploy/postgresql.deploy</span></span></code></pre>
Paste the following</p>
umask 0177</span></span>
DOMAIN=psql.example.com</span></span>
DATA_DIR=/var/lib/postgresql/16/main</span></span>
cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem $DATA_DIR/server.crt</span></span>
cp /etc/letsencrypt/live/$DOMAIN/privkey.pem $DATA_DIR/server.key</span></span>
chown postgres:postgres $DATA_DIR/server.crt $DATA_DIR/server.key</span></span></code></pre>
Save and exit the file.</p>
Give file executable permission</p>
sudo</span> chmod +x /etc/letsencrypt/renewal-hooks/deploy/postgresql.deploy</span></span></code></pre>
Get the path of PostgreSQL configuration file</p>
sudo</span> -u</span> postgres psql</span> -U</span> postgres</span> -c</span> 'SHOW config_file'</span></span></code></pre>
Open the file in edit mode and update the SSL section of the file as below:</p>
sudo</span> nano /etc/postgresql/16/main/postgresql.conf</span></span></code></pre>ssl = on</span></span>
ssl_cert_file = 'server.crt'</span></span>
ssl_key_file = 'server.key'</span></span>
ssl_prefer_server_ciphers = on</span></span></code></pre>
Locate the Connection Settings section and verify the listen_address is to * for all addresses. Make sure the line is not commented out.</p>
listen_addresses = '*'</span></span></code></pre>
Edit pg_hba.conf</code> file which is in the same dir as config file:</p>
sudo</span> nano /etc/postgresql/16/main/pg_hba.conf</span></span></code></pre>
Add the following line to enable connection over ssl for any user and database:</p>
# TYPE DATABASE USER ADDRESS METHOD</span></span>
</span>
hostssl all all 0.0.0.0/0 scram-sha-256</span></span>
hostssl all all ::/0 scram-sha-256</span></span></code></pre>

Although in above config it’s shown to allow connection from all IPv4 and IPv6 addresses, however from the security point of view only allow the ip address of your connecting machine (client).</p>
</blockquote>
Renew the SSL certificate</p>
sudo</span> certbot renew</span> --force-renewal</span></span></code></pre>
Restart PostgreSQL</p>
sudo</span> service postgresql restart</span></span></code></pre>
Connect to your db remotely</p>
psql</span> -d</span> "dbname=your_db_name sslmode=require"</span> -h</span> psql.example.com</span> -U</span> your_db_user</span></span></code></pre>

Vivek Shukla - Selfhost

Setup Redis TLS With Self-signed Certificate

🔗</a>Redis Connection URL</h2> Since we want to connect to redis using TLS connection, so the protocol in the url will be rediss</code> (with double “ss”).</p> rediss://:<your_password_here>@<redis_server_ip>:6379/0#insecure</span></span></code></pre>

Self Host PostgreSQL With TLS

🔗</a>Redis Connection URL</h2>
Since we want to connect to redis using TLS connection, so the protocol in the url will be `rediss</code> (with double “ss”).</p>`
`rediss://:<your_password_here>@<redis_server_ip>:6379/0#insecure</span></span></code></pre>`