Skip to content

Commit

Permalink
Ability to connect to Redis cluster using SSL/TLS
Browse files Browse the repository at this point in the history
Added `REDIS_SCHEME` setting to be able to specify whether connection
with Redis server should be secure (`rediss`) or nor (`redis`).

This defaults to `redis` for retrocompatibility but can be set to
`rediss` (notice the additional `s` as in "secure") to allow use
encryption in-transit when this is enabled on the Redis cluster.

This is necessary necessary to connect to the Redis cluster on AWS
ElastiCache which uses TLS for encryption in transit.

Also set `timeout=30` in Django Channels' settings as by default never
times out (which is never a great idea, especially on production).

Part of ticket: https://trello.com/c/YG9anK8A
  • Loading branch information
xoen committed Oct 1, 2020
1 parent 8cd6db2 commit 6d1f2b5
Showing 1 changed file with 11 additions and 2 deletions.
13 changes: 11 additions & 2 deletions controlpanel/settings/common.py
Original file line number Diff line number Diff line change
Expand Up @@ -456,16 +456,25 @@
REDIS_HOST = os.environ.get('REDIS_HOST', 'localhost')
REDIS_PASSWORD = os.environ.get('REDIS_PASSWORD')
REDIS_PORT = os.environ.get('REDIS_PORT', '6379')
REDIS_SCHEME = os.environ.get("REDIS_SCHEME", "redis")
if REDIS_SCHEME not in ["redis", "rediss"]:
raise ValueError(f"Invalid value for 'REDIS_SCHEME' environment variable. Must be 'redis' or 'rediss' (to use SSL/TLS). It was '{REDIS_SCHEME}' which is invalid.")

REDIS_URI = f"{REDIS_SCHEME}://{REDIS_HOST}:{REDIS_PORT}/1"

# -- Async

ASGI_APPLICATION = f"{PROJECT_NAME}.routing.application"

# See: https://pypi.org/project/channels-redis/
CHANNEL_LAYERS = {
'default': {
'BACKEND': 'channels_redis.core.RedisChannelLayer',
'CONFIG': {
'hosts': [{'address': (REDIS_HOST, REDIS_PORT)}],
'hosts': [{
"address": REDIS_URI,
"timeout": 30,
}],
},
},
}
Expand All @@ -477,7 +486,7 @@
CACHES = {
"default": {
"BACKEND": "django_redis.cache.RedisCache",
"LOCATION": f"redis://{REDIS_HOST}:{REDIS_PORT}/1",
"LOCATION": REDIS_URI,
"OPTIONS": {
"CLIENT_CLASS": "django_redis.client.DefaultClient",
"PASSWORD": f"{REDIS_PASSWORD}"
Expand Down

0 comments on commit 6d1f2b5

Please sign in to comment.