Self hosted Redis for your cache, queue or sessions, kept private

What will run out first? Memory.

Memory, almost always. Redis holds everything you store in RAM and writes to disk only to survive a restart. Its own FAQ says the processor is rarely what holds it back; memory or the network is.

To get a feel for the numbers, the Redis FAQ measured an empty instance at roughly 3 MB, a million small text keys at roughly 85 MB, and a million five-field hashes at roughly 160 MB. Your keys will differ, so load a sample and ask Redis with INFO memory.

Then leave room for two things the Redis administration guide warns about:

• Overhead. Set the maxmemory limit below what is free. The guide's own example: with 10 GB free, set 8 or 9.
• Saving. While Redis saves to disk, a busy instance that keeps writing can need up to twice its usual memory, in proportion to how much changes during the save.

Our rule of thumb from that: if Redis saves to disk and writes a lot, give the server more than double the maxmemory you set. A 32 GB machine is comfortable with a 12 GB limit.

Tell Redis what job it is doing

What happens when memory fills up is your choice, made with the maxmemory-policy setting. Out of the box maxmemory is unset, so there is no limit at all; once you set one, the default policy is noeviction: Redis keeps everything and refuses new writes with an error. Match it to the job (the matching is our advice; the behaviour is from the Redis eviction docs):

• Cache. Use allkeys-lru, which drops the least recently used keys; the eviction docs rate it a sound default when some keys are read far more than others. Losing a key just means your app fetches it again.
• Job queue. Keep noeviction. A job Redis throws away is work that never happens, and an error when the queue is full is far easier to notice.
• Session store. Keep noeviction and buy enough memory. If logging a few idle users out is acceptable, volatile-lru removes only keys that carry an expiry time.

Gave your cache a memory limit and kept the default noeviction? Then it will not shrink by itself: once the limit is hit, writes fail until you change the policy or add memory.

Redis or Valkey: which licence comes with it?

You pay no licence fee for either; the difference is in the terms you agree to. As the Redis licences page sets it out:

Redis says plainly that RSALv2 and SSPLv1 are not open source licences, and that AGPLv3 is. Redis describes RSALv2 as having two limits: no commercialising Redis or running it as a managed service for other people, and no removing or hiding its licence notices. SSPLv1 attaches conditions to providing it as a service. If your plans come anywhere near selling Redis itself, read the licence texts with a lawyer. Valkey started life as a Redis fork, and its docs describe the settings you will use below.

Up and running in an evening

1. Close the doors first. Switch on ufw with only SSH allowed, and confirm IPV6=yes in its defaults so the IPv6 side is closed too.
2. Apply the two kernel settings the Redis guide asks for: memory overcommit set to 1, so saving to disk does not fail, and transparent huge pages off, which otherwise slow Redis down after each save.
3. Install Redis from its official package repository, with the commands from the Redis install page. Prefer Valkey? Its install guide covers Debian-based systems with two commands, sudo apt update then sudo apt install valkey.
4. Make a long random password, put it in the config file with your memory limit and policy, lock the file down and restart.

# 1. firewall: SSH in, nothing else
grep IPV6 /etc/default/ufw
sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

# 2. kernel settings from the Redis administration guide
echo 'vm.overcommit_memory = 1' | sudo tee -a /etc/sysctl.conf
sudo sysctl vm.overcommit_memory=1
echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled

# 3. Redis from packages.redis.io
sudo apt-get install lsb-release curl gpg
curl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
sudo chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list
sudo apt-get update
sudo apt-get install redis

The huge pages setting resets when the server reboots, so add it to your boot routine. The guide also recommends swap as large as your RAM: without it, a Redis that outgrows memory can be killed outright instead of just slowing down.

openssl rand -hex 32
# copy the output, then open the config: sudoedit /etc/redis/redis.conf

# lines to set in /etc/redis/redis.conf
bind 127.0.0.1 -::1
protected-mode yes
requirepass THE_64_CHARACTER_STRING_YOU_COPIED
maxmemory 12gb
# cache: allkeys-lru / queue or sessions: noeviction
maxmemory-policy noeviction
# queue or sessions: yes / pure cache: no
appendonly yes
appendfsync everysec

# back in the shell
sudo chown redis:redis /etc/redis/redis.conf
sudo chmod 640 /etc/redis/redis.conf
sudo systemctl restart redis-server
sudo ss -ltnp | grep 6379
redis-cli --askpass ping

Installed Valkey instead? The paths above belong to the Redis package. Valkey brings its own config file, service name and valkey-cli. Running systemctl list-units --type=service | grep -i valkey shows the service, and the same settings go into Valkey's own config file.

Keep port 6379 to yourself

Redis expects to sit behind your application, never in front of the public. Its security page says Redis is built for trusted clients, and that one FLUSHALL from anybody who can reach the port erases everything. Your setup above stacks three protections, plus a safety net:

1. Loopback only. bind 127.0.0.1 -::1 is already the default in the redis.conf Redis ships. If another of your servers needs Redis, add a private address, never a public one.
2. Protected mode. Leave it switched on. It is your backup: should the password ever disappear from the config, Redis goes back to serving local clients only.
3. A password. The password is stored as plain text, so the config file is set to 640: readable by its owner and the redis group only. ACL users, which give each app its own login and limits, are the method Redis recommends.
4. The firewall. ufw blocks 6379 on IPv4 and IPv6 even if a config change goes wrong.

Never type the password after redis-cli -a: anything on a command line can be read by other users in the process list and lingers in your shell history. --askpass prompts for it instead. And if a second server must reach Redis, open 6379 to that one address only and switch on TLS, since Redis sends the password unencrypted.

Make sure a restart does not wipe it

Redis has two ways to save to disk. RDB takes a full snapshot now and then, which is quick to restore but loses whatever changed since the last one. AOF records each write as it happens; with the default of flushing every second, a crash costs you about one second of writes. If losing writes matters, as it does for queues and sessions, the Redis persistence page points you to both together.

Backups are simple: Redis finishes each snapshot under a temporary name and then swaps it into place, so you can copy the dump.rdb file while Redis runs. Keep hourly copies for a couple of days, daily ones for one to two months, and send one off the server every day. Because AOF writes to disk every second, a server with NVMe storage helps keep those writes from slowing replies; the Redis latency guide names disk I/O as one cause of slow answers.

The server that fits

Start from memory, then look through our dedicated servers. Each one is a whole machine for you alone, so no neighbour can eat the RAM your cache depends on.

• A small cache or session store: most compact cartridge models take between 8 and 32 GB, while the Xeon D-1587 model reaches 128 GB and carries a 1.92 TB NVMe drive.
• Redis next to your app and database: a one- or two-processor server, where the two-processor models reach 256 GB, or 1 TB on the made-to-order EPYC.
• One huge dataset: the four-processor machines hold as much as half a terabyte in one box.

A ready server is handed over within 30 minutes of the payment being approved. Outgrow the memory later and you can add more to the same machine, keeping its IP address, or have one built to your exact size. A console comes with every rack server and blade, and with two cartridge models (m510, m710x), so a firewall slip does not lock you out. You run Redis yourself; we keep the hardware and the network running. Pairing it with a database? Our PostgreSQL guide covers that side.

Signs you need more than one server

One machine stops being enough when your data will not fit in the biggest memory you can buy, because Redis has no plan to spill to disk and the answer is splitting data across instances. It also stops being enough when Redis must keep answering through a hardware fault: that takes replicas on a second server. One warning from the Redis guide if you go that way: a primary that saves nothing to disk must not restart by itself, or it comes back empty and its replicas copy the emptiness.

Questions people ask

Does it cost anything to run Redis yourself?

Neither Redis nor Valkey charges a licence fee. Redis 8 offers three licences (RSALv2, SSPLv1, AGPLv3), and by Redis's own description RSALv2 forbids commercialising it or running it as a managed service for others. Valkey uses the BSD 3-Clause licence. Check the licence text against your plans; the server is the bill.

How big a server does Redis need?

Start from the size of your data in memory, measured with INFO memory, then add headroom. Keep maxmemory below free RAM, as the Redis guide advises, and if Redis saves to disk while writing heavily, allow for memory use to double during each save.

Is Valkey a drop-in for Redis?

Valkey grew out of the open-source Redis code, and its documentation covers the settings this page relies on: the listening address, protected mode, passwords and ACL users, the memory limit and both ways of saving. On Ubuntu, a compatibility package (valkey-redis-compat) even provides the familiar redis-cli name. Try your application against it on a test copy before switching.

Can my web servers on other machines use it?

Yes, as long as only they can reach it. Allow port 6379 from their addresses alone in the firewall, keep the password or ACL users, and turn on TLS so the password does not cross the network in the clear. Never open the port to everyone.

Should a cache save to disk at all?

It does not have to. The Redis persistence docs note that turning persistence off is sometimes done for caching, since a lost key is only a miss. Keeping RDB snapshots on means the cache starts warm after a restart instead of empty.