Merge pull request #24 from InnovationMinds/main

feat(cache): enhance Redis cache configuration with ACL and TLS support

Author: axelmarciano

apps/docs/docs/cache.mdx

@@ -12,6 +12,7 @@ The **Expo Open OTA server** uses a cache to improve performance and reduce serv
 The cache is primarily used for:
 
 1. **Storing the computed `lastUpdateId` for a given platform and runtime version**
+
    - This prevents the need to recompute the last update for every request, significantly speeding up responses.
 
 2. **Caching the computed manifest**
@@ -22,19 +23,20 @@ The cache is primarily used for:
 The environment variables required for each storage solution are listed below, you can set them in a `.env` file in the root of the project or keep them in a safe place to prepare for deployment.
 :::
 
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
+import Tabs from "@theme/Tabs";
+import TabItem from "@theme/TabItem";
 
 <Tabs queryString="cache" defaultValue="local">
   <TabItem value="local" label="Local cache" default>
   :::warning
 
-  This cache solution is not recommended for production use. It is intended for development and testing purposes only.
-  If you really want to use it in production, make sure to not have multiple instances of the server running, as the cache is stored locally and not shared between instances.
+This cache solution is not recommended for production use. It is intended for development and testing purposes only.
+If you really want to use it in production, make sure to not have multiple instances of the server running, as the cache is stored locally and not shared between instances.
+
+:::
+Local cache is the default cache solution used by the server. It stores the cache in memory and is not shared between instances of the server. This means that the cache is lost when the server is restarted.
+No additional configuration is required to use the local cache.
 
-  :::
-   Local cache is the default cache solution used by the server. It stores the cache in memory and is not shared between instances of the server. This means that the cache is lost when the server is restarted.
-   No additional configuration is required to use the local cache.
   </TabItem>
   <TabItem value="redis" label="Redis">
     To use Redis as your cache solution, you need to set the following environment variables:
@@ -43,6 +45,26 @@ import TabItem from '@theme/TabItem';
     REDIS_PORT=your-redis-port
     REDIS_PASSWORD=your-redis-password
     REDIS_USE_TLS=true // optional if you are using a TLS connection
+    REDIS_USERNAME=your-redis-username // optional for ACL authentication
+    REDIS_CA_CERT_B64=base64-encoded-ca-certificate // optional for TLS with custom CA
     ```
+
+    :::tip TLS/SSL Configuration
+
+    If you're using Redis with TLS/SSL and a custom CA certificate:
+    - Set `REDIS_USE_TLS=true`
+    - Set `REDIS_CA_CERT_B64` to your base64-encoded PEM certificate
+    - To encode your certificate: `cat certificate.pem | base64 -w 0`
+
+    :::
+
+    :::info ACL Authentication
+
+    If your Redis server uses ACL (Access Control Lists):
+    - Set `REDIS_USERNAME` to your Redis username
+    - Ensure `REDIS_PASSWORD` is set to the corresponding password
+
+    :::
+
   </TabItem>
 </Tabs>

apps/docs/docs/environment.mdx

@@ -33,7 +33,9 @@ You can set these variables in a `.env` file for local development or in your de
 | `REDIS_HOST` | ✅ if CACHE_MODE = `redis` | Redis host | `127.0.0.1` | [Ref](/docs/cache?cache=redis) |
 | `REDIS_PORT` | ✅ if CACHE_MODE = `redis` | Redis port | `6379` | [Ref](/docs/cache?cache=redis) |
 | `REDIS_PASSWORD` | ✅ if CACHE_MODE = `redis` | Redis password | `password` | [Ref](/docs/cache?cache=redis) |
-
+| `REDIS_USE_TLS`     | ❌ | Enable TLS/SSL connection             | `true`          | [Ref](/docs/cache?cache=redis) |
+| `REDIS_USERNAME`    | ❌ | Redis username for ACL authentication | `myuser`        | [Ref](/docs/cache?cache=redis) |
+| `REDIS_CA_CERT_B64` | ❌ | Base64-encoded CA certificate for TLS | `Base64 string` | [Ref](/docs/cache?cache=redis) |
 
 ### 📦 **Storage Configuration**
 | Name | Required | Description | Example | Reference |

internal/cache/cache.go

@@ -56,7 +56,10 @@ func GetCache() Cache {
 			password := config.GetEnv("REDIS_PASSWORD")
 			port := config.GetEnv("REDIS_PORT")
 			useTLS := config.GetEnv("REDIS_USE_TLS") == "true"
-			cacheInstance = NewRedisCache(host, password, port, useTLS)
+			// ACL and TLS configuration
+			username := config.GetEnv("REDIS_USERNAME")
+			caCertB64 := config.GetEnv("REDIS_CA_CERT_B64")
+			cacheInstance = NewRedisCache(host, password, port, useTLS, username, caCertB64)
 		default:
 			panic("Unknown cache type")
 		}

internal/cache/redisCache.go

@@ -3,8 +3,11 @@ package cache
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
+	"encoding/base64"
 	"errors"
 	"fmt"
+	"log"
 	"time"
 
 	"github.com/redis/go-redis/v9"
@@ -17,14 +20,43 @@ type RedisCache struct {
 	port     string
 }
 
-func NewRedisCache(host, password, port string, useTLS bool) *RedisCache {
+func NewRedisCache(host, password, port string, useTLS bool, username, caCertB64 string) *RedisCache {
 	opts := &redis.Options{
 		Addr:     host + ":" + port,
 		Password: password,
 	}
 
+	// Configure ACL username if provided
+	if username != "" {
+		opts.Username = username
+	}
+
+	// Configure TLS/SSL
 	if useTLS {
-		opts.TLSConfig = &tls.Config{}
+		tlsConfig := &tls.Config{
+			MinVersion: tls.VersionTLS12,
+		}
+
+		// Load CA certificate if provided
+		if caCertB64 != "" {
+			// Decode base64 certificate
+			caCertPEM, err := base64.StdEncoding.DecodeString(caCertB64)
+			if err != nil {
+				log.Printf("Failed to decode CA certificate from base64: %v", err)
+				log.Printf("WARNING: Proceeding with TLS connection without custom CA certificate")
+			} else {
+				// Create certificate pool and add CA certificate
+				certPool := x509.NewCertPool()
+				if !certPool.AppendCertsFromPEM(caCertPEM) {
+					log.Printf("Failed to append CA certificate to pool")
+					log.Printf("WARNING: Proceeding with TLS connection without custom CA certificate")
+				} else {
+					tlsConfig.RootCAs = certPool
+				}
+			}
+		}
+
+		opts.TLSConfig = tlsConfig
 	}
 
 	client := redis.NewClient(opts)