theta42/jump-host
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Redis had zero persistence — every rebuild wiped sessions, (#18)

Browse Source 
in-flight OAuth logins, and any admin-created API token

redis-server ran with --save '' --appendonly no (deliberately ephemeral,
per the original "audit/metrics/session storage" framing). That stopped
being a safe assumption once API tokens (PATs) lived in this same Redis
-- a PAT is supposed to be a stable, long-lived credential, not
disposable session state, but every `docker rm -f jump-host` + rebuild
silently invalidated every one that existed.

Matches proxy's existing pattern exactly: AOF + periodic RDB persisted
to $REDIS_DATA_DIR (default /data), which the deployment mounts as a
volume (see the companion theta-env change).

Verified against a live container: minted a real PAT, force-recreated
the container (docker rm -f + rebuild), confirmed the same token still
authenticates afterward.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-28 15:46:40 -04:00
committed by GitHub
parent 21ef8960c4
commit ec4ca97af4
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-entrypoint.sh
+11 -3
View File
@@ -12,9 +12,17 @@ if [[ -f /config/jump-secrets.js ]]; then
info "Loaded config from /config/jump-secrets.js" info "Loaded config from /config/jump-secrets.js"
fi fi
# Redis for audit/metrics/session storage (app connects to 127.0.0.1:6379). # Redis for audit/metrics/session AND api-token storage (app connects to
info "Starting redis..." # 127.0.0.1:6379). Persisted (AOF + periodic RDB) to /data, which the
redis-server --daemonize yes --save '' --appendonly no # deployment should mount as a volume -- without this, every container
# recreation silently wiped every session, in-flight OAuth login, and any
# admin-created API token, which is especially bad for the last one since a
# PAT is meant to be a stable, long-lived credential, not session state.
REDIS_DATA_DIR="${REDIS_DATA_DIR:-/data}"
mkdir -p "$REDIS_DATA_DIR"
info "Starting redis (AOF persisted to $REDIS_DATA_DIR)..."
redis-server --daemonize yes --dir "$REDIS_DATA_DIR" --appendonly yes \
--appendfilename appendonly.aof --save 900 1 --save 300 10 --save 60 10000
# Wait for redis to answer before starting the app. # Wait for redis to answer before starting the app.
for _ in $(seq 1 20); do for _ in $(seq 1 20); do