From 61bb1fefd632424b918a8a9afb8e3ab88494f97b Mon Sep 17 00:00:00 2001
From: Jeremy Nguyen <nguyen.jeremyt@gmail.com>
Date: Wed, 1 Jul 2026 17:48:39 -0700
Subject: [PATCH] feat: add Redis for Authelia session storage

- Add Redis container to docker-compose
  - Configure Redis with ACL and redis.conf
- Update Authelia configuration to use Redis for session storage
---
 .vscode/extensions.json          |  6 +++++-
 files/authelia.configuration.yml |  5 +++++
 files/docker-compose.yml         | 25 +++++++++++++++++++++++++
 files/redis.conf                 | 26 ++++++++++++++++++++++++++
 main.tf                          | 18 +++++++++++++++++-
 templates/redis.users.acl.tftpl  |  2 ++
 6 files changed, 80 insertions(+), 2 deletions(-)
 create mode 100644 files/redis.conf
 create mode 100644 templates/redis.users.acl.tftpl

diff --git a/.vscode/extensions.json b/.vscode/extensions.json
index e35e07e..5b21d22 100644
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -1,3 +1,7 @@
 {
-  "recommendations": ["hashicorp.terraform", "esbenp.prettier-vscode"]
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "hashicorp.terraform",
+    "redis.redis-for-vscode"
+  ]
 }
diff --git a/files/authelia.configuration.yml b/files/authelia.configuration.yml
index 84b3e91..722f518 100644
--- a/files/authelia.configuration.yml
+++ b/files/authelia.configuration.yml
@@ -54,6 +54,11 @@ session:
       domain: '{{ env "SERVER_DOMAIN" }}'
       authelia_url: 'https://auth.{{ env "SERVER_DOMAIN" }}'
       same_site: lax
+  redis:
+    host: "redis"
+    port: 6379
+    username: "jeremy"
+    password: '{{ secret "/run/secrets/authelia-redis-password" }}'
 
 # Regulation Configuration
 regulation:
diff --git a/files/docker-compose.yml b/files/docker-compose.yml
index ae21d40..d66deaa 100644
--- a/files/docker-compose.yml
+++ b/files/docker-compose.yml
@@ -153,6 +153,7 @@ services:
         "storage-encryption-key",
         "hmac-secret",
         "authelia-oidc-signing-key",
+        "authelia-redis-password",
       ]
 
   wg-easy:
@@ -173,6 +174,24 @@ services:
     ports:
       - 51820:51820/udp
 
+  redis:
+    container_name: redis
+    image: redis:8
+    restart: unless-stopped
+    command: redis-server /usr/local/etc/redis/redis.conf
+    volumes:
+      - /mnt/oraclevdb/redis/:/data/
+    configs:
+      - source: redis-config
+        target: /usr/local/etc/redis/redis.conf
+        uid: "999"
+        gid: "999"
+    secrets:
+      - source: redis-users-acl
+        target: /usr/local/etc/redis/users.acl
+        uid: "999"
+        gid: "999"
+
 configs:
   rclone-config:
     file: ./rclone.conf
@@ -193,6 +212,8 @@ configs:
     file: ./fah.config.xml
   authelia-config:
     file: ./authelia.configuration.yml
+  redis-config:
+    file: ./redis.conf
 
 secrets:
   vaultwarden-database-url:
@@ -211,3 +232,7 @@ secrets:
     file: "./storage-encryption-key"
   authelia-oidc-signing-key:
     file: "./authelia-oidc-signing-key"
+  authelia-redis-password:
+    file: "./authelia-redis-password"
+  redis-users-acl:
+    file: "./redis.users.acl"
diff --git a/files/redis.conf b/files/redis.conf
new file mode 100644
index 0000000..ec33bff
--- /dev/null
+++ b/files/redis.conf
@@ -0,0 +1,26 @@
+# Network
+bind 0.0.0.0
+protected-mode no
+port 6379
+tcp-keepalive 300
+
+# Snapshotting
+save 900 1
+save 300 10
+save 60 10000
+
+# Security
+aclfile /usr/local/etc/redis/users.acl
+
+# Memory management
+maxmemory 256mb
+maxmemory-policy allkeys-lru
+
+# Append only Mode
+appendonly yes
+appendfsync everysec
+auto-aof-rewrite-percentage 100
+auto-aof-rewrite-min-size 64mb
+
+# General
+loglevel notice
diff --git a/main.tf b/main.tf
index 989f4ff..ee434b6 100644
--- a/main.tf
+++ b/main.tf
@@ -79,7 +79,7 @@ resource "oci_vault_secret" "authelia_oidc_signing_key" {
 }
 
 locals {
-  authelia_secrets = ["hmac_secret", "jwt_secret", "session_secret", "storage_encryption_key"]
+  authelia_secrets = ["hmac_secret", "jwt_secret", "session_secret", "storage_encryption_key", "redis_password"]
 }
 
 resource "oci_vault_secret" "authelia" {
@@ -372,6 +372,10 @@ locals {
           path    = "/home/jeremy/storage-encryption-key",
           content = local.authelia.storage_encryption_key
         },
+        {
+          path    = "/home/jeremy/authelia-redis-password",
+          content = local.authelia.redis_password
+        },
         {
           path    = "/home/jeremy/htpasswd",
           content = "${var.rclone_config.username}:${bcrypt(var.rclone_config.password)}",
@@ -426,6 +430,18 @@ locals {
             }
           }))
         },
+        {
+          encoding = "gzip+base64"
+          path     = "/home/jeremy/redis.conf",
+          content  = base64gzip(file("${path.module}/files/redis.conf"))
+        },
+        {
+          encoding = "gzip+base64"
+          path     = "/home/jeremy/redis.users.acl",
+          content = base64gzip(templatefile("${path.module}/templates/redis.users.acl.tftpl", {
+            password = sha256(local.authelia.redis_password)
+          }))
+        },
         {
           encoding = "gzip+base64",
           path     = "/home/jeremy/gatus-config.yaml",
diff --git a/templates/redis.users.acl.tftpl b/templates/redis.users.acl.tftpl
new file mode 100644
index 0000000..fba0c51
--- /dev/null
+++ b/templates/redis.users.acl.tftpl
@@ -0,0 +1,2 @@
+user default off sanitize-payload resetchannels -@all
+user jeremy on sanitize-payload #${password} ~* &* +@all