Skip to content

Operations

This page covers running the cache day to day: how it is secured, how to manage the service, where logs go, what to back up, how updates work and how to get help.

Security model

  • Loopback and TLS only. Valkey listens on 127.0.0.1:6379 with TLS 1.2 or 1.3. The plaintext port is off.
  • Password and ACL. The default user is off. The only user is cache, limited to keys named cache:* and to data commands. Admin, scripting and dangerous commands are denied.
  • Per-instance secrets. The CA, server certificate, password and ACL are created on first boot. The image contains none of them.
  • File permissions. The ubuntu user cannot read the private keys, the password file or the ACL. Clients use the public CA copy in /usr/local/share/sushi/valkey/ca.pem.
  • Service sandbox. The valkey service runs as the valkey user, can write only to /var/lib/valkey and sees /etc/valkey as read-only.

Keep the security group closed to inbound traffic unless you have opened the cache to your VPC, and connect with Session Manager or SSH restricted to your administrative range.

Manage the service

sudo systemctl status valkey
sudo systemctl restart valkey
sudo systemctl stop valkey

The first-boot service, sushi-valkey-firstboot, runs before valkey on every boot. It creates anything that is missing and checks that existing certificates and keys still belong together.

Logs

Valkey logs to the systemd journal:

sudo journalctl -u valkey -n 100 --no-pager
sudo journalctl -u sushi-valkey-firstboot --no-pager

Backups

There is nothing to back up in the cache itself: restarts and evictions discard it, and your application refills it.

If you want a replacement instance to keep the same password and CA, so clients do not need new settings, copy these together over a private channel:

  • /etc/valkey/credentials/cache.password
  • /etc/valkey/tls/
  • /etc/valkey/valkey.conf
  • /etc/valkey/users.acl

Restore them with the same ownership and permissions, before Valkey starts.

Updates

  • Ubuntu packages, including OpenSSL, receive unattended security updates.
  • Valkey itself is not updated by apt. A new Valkey release comes as a new version of the image. There is no in-place upgrade: launch the new version, copy the identity files above if you want to keep them, and point clients at the new instance. Expect an empty cache.

Support

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with your instance's Valkey version (valkey-server --version), what you ran and the error. Never include the password or private keys. Support coverage beyond installation questions requires a separate agreement. The Valkey project does not provide support for this image.