erikdubbelboer / phpRedisAdmin

Simple web interface to manage Redis databases.
http://dubbelboer.com/phpRedisAdmin/
3.11k stars 666 forks source link

Feature Request - Support TLS #193

Closed gwharton closed 3 months ago

gwharton commented 1 year ago

Please support tls connections for redis servers.

AWS Elasticache redis instances with AUTH enabled now only support tls connections.

erikdubbelboer commented 1 year ago

In theory this is already possible. I don't have a setup to test. But I think you can set host to something like tls://hostname?ssl[verify_peer]=0 or tls://hostname?ssl[cafile]=private.pem&ssl[verify_peer]=1. Can you check if that works?

gwharton commented 1 year ago

Ahh yes, it should work, but looking at the code, only if you do not set the port variable.

https://github.com/erikdubbelboer/phpRedisAdmin/blob/bf71b74103b4aa506606f63344835f13ac42294d/includes/common.inc.php#L116-L121

gwharton commented 1 year ago

I tried not setting the port variable to see if I could use a full connection string, and alas the following code automatically sets the port setting if it doesn't exist. https://github.com/erikdubbelboer/phpRedisAdmin/blob/bf71b74103b4aa506606f63344835f13ac42294d/includes/config.environment.inc.php#L45-L54 I'm guessing this only becomes an issue when setting the servers from environment variables, i.e in docker. I haven't been able to try this when setting the servers from config.inc.php which I suspect will work if you don't declare a port.

gwharton commented 1 year ago

OK, ive tried it using the config file instead of environment variables.

      array(
          'name'   => 'master.xxxx.xxxx.euw2.cache.amazonaws.com',
          'host'   => 'tls://master.xxxx.xxxx.euw2.cache.amazonaws.com:6379',
          'port'   => '',
          'filter' => '*',
          'scheme' => 'tcp',
          'path'   => '',
          'hide'   => false,
          'auth' => 'xxxx'
      )

This works and seems to connect to the redis server.

erikdubbelboer commented 1 year ago

Great, I'll keep this task open for if one day I have time to improve support and fix that port logic.