Valkey from each distribution's packages, with a write-only password, in one OpenTofu-style config

[jamesconwaydev]

Hi all. I built a Valkey circuit for Conn3x, a fork of OpenTofu that configures servers over SSH: https://github.com/conn3xorg/circuit-valkey. If you already create your VMs with OpenTofu or Terraform, the same conn3x apply now sets Valkey up on them too.

module "valkey" {
  source = "github.com/conn3xorg/circuit-valkey?ref=v0.1.0"

  hosts                = { cache = "192.168.1.40" }
  ssh_private_key_file = "~/.ssh/id_ed25519"

  password         = var.valkey_password
  bind             = ["127.0.0.1", "192.168.1.40"]
  maxmemory        = "512mb"
  maxmemory_policy = "allkeys-lru"
}

It installs each distribution's own package, since all four I test on ship one now (Ubuntu 24.04 has 7.2, Debian 13 8.1, Rocky Linux 10 8.0, Fedora 45 9.1), and puts its settings in an included file rather than editing valkey.conf. The password is write-only, so it never lands in the state file or the plan. It also sets vm.overcommit_memory = 1, the warning Valkey prints on every start until someone does.

CI applies it on all four, then checks that SET and GET work with the password, that a client without it gets NOAUTH, and that a key survives a restart with AOF on. By hand it ran on an Ubuntu 24.04 droplet and on Rocky Linux 10 with SELinux enforcing on port 6380, which the circuit labels redis_port_t, through a reboot.

Thanks for keeping Valkey open and for getting it into the distributions so fast. Questions and "you're doing it wrong" both welcome.