The Redis driver previously connected only over plaintext TCP, so a
Redis server configured for TLS-only (tls-port) was unreachable. Add an
opt-in TLS transport built on the hiredis_ssl library, covering both the
synchronous userdb path and the asynchronous statsdb path.
Fixes#651
New connection-string keys (for --redis-userdb and --redis-statsdb):
tls/ssl, ca/cacert, capath, cert, clientkey, sni/servername, verify
(peer|none). Server-certificate verification is on by default.
- Extract the connection-string parser into a dependency-free unit
(dbd_redis_conninfo.c/.h) and unit-test it
(tests/test_redis_conninfo.c).
- hiredis_ssl is detected via pkg-config; without it tls=true is
rejected with an explicit error and the build still compiles
(hiredis-only).
- The blocking sync handshake honors connect_timeout so a plaintext
endpoint mistakenly addressed with tls=true cannot hang.
- Document the options in docs/Redis.md, the man page, and example
config.
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This is not a long term documentation works - this is a temp proposal to
modernize existing documentation
- Create docs folder
- Move existing documentation files into docs
- Split one massive INSTALL files into smaller files (no text editing
was done except small markdown header formatting)
- Rename files to be markdowns for nicer rendering
- Bad md rendering is expected in many places
