devilry / devilry-django

Devilry project main repository
http://devilry.org
BSD 3-Clause "New" or "Revised" License
51 stars 24 forks source link

RQ Worker can't run when limited to one Redis database #1309

Open torgeirl opened 2 months ago

torgeirl commented 2 months ago

When running multiple services against the same Redis cluster it seems to be good practice to limit each of the services' Redis user to only have access to their assigned Redis database.

In RQ_QUEUES you can specify which of Redis' 16 (0-15) databases the service should use, ie.:

RQ_QUEUES = {
    'default': {
        'HOST': 'redis-server',
        'PORT': 6379,
        'DB': 3,
        'USERNAME': 'redis_username',
        'PASSWORD': 'redis_password',
        'DEFAULT_TIMEOUT': 500,
        'SSL': True,
    },
    (...)

And in Redis 7.0 the user can be set to only access that database:

redis-server:6379> ACL SETUSER redis_username >redis_password +@all ~3__*:*

Running Devilry's RQ Worker with this setup does however yield an error:

redis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments

Replacing ~3__*:* with ~* (access to all 16 databases) it runs just fine.

It is unclear if this is a problem in Redis v7.0, a limitation in django-rq, a bug in Devilry 6.3.3's implementation, or a documentation mismatch/something I have misunderstood. Perhaps Devilry's RQ Worker tries to read all databases before using the specified database?