Redis في الإنتاج: الـ ACLs والـ Cluster والمراقبة

import Redis from "ioredis";

const admin = new Redis(process.env.REDIS_URL);
await admin.flushall();

// user للـ app: keys بتبدأ بـ cache: بس، ومن غير أوامر خطيرة
await admin.acl("SETUSER", "app", "reset", "on", ">app-secret", "~cache:*", "+@read", "+@write", "-@dangerous");

// enableReadyCheck: false لأن ioredis بيسأل INFO أول ما يتصل، والـ user ده مالوش INFO
const app = new Redis({ host: "localhost", port: 6379, username: "app", password: "app-secret", enableReadyCheck: false });
const tryIt = async (label, fn) => {
  try {
    console.log(label.padEnd(28), "→", await fn());
  } catch (err) {
    console.log(label.padEnd(28), "→", err.message.split(":")[0]);
  }
};
await tryIt("SET cache:home", () => app.set("cache:home", "html"));
await tryIt("GET cache:home", () => app.get("cache:home"));
await tryIt("SET sess:7 (key مش مسموح)", () => app.set("sess:7", "x"));
await tryIt("FLUSHALL", () => app.flushall());
await tryIt("KEYS *", () => app.keys("*"));
await tryIt("CONFIG GET", () => app.config("GET", "maxmemory"));

const probe = new Redis(process.env.REDIS_URL);
await tryIt("AUTH app بـ password غلط", () => probe.call("AUTH", "app", "wrong"));
for (const c of [admin, app, probe]) c.disconnect();

$ node main.js
SET cache:home               → OK
GET cache:home               → html
SET sess:7 (key مش مسموح)    → NOPERM this user has no permissions to access one of the keys used as arguments
FLUSHALL                     → NOPERM this user has no permissions to run the 'flushall' command or its subcommand
KEYS *                       → NOPERM this user has no permissions to run the 'keys' command or its subcommand
CONFIG GET                   → NOPERM this user has no permissions to run the 'config' command or its subcommand
AUTH app بـ password غلط     → WRONGPASS invalid username-password pair or user is disabled.

import Redis from "ioredis";

const cluster = new Redis.Cluster([{ host: "127.0.0.1", port: 7001 }]);

// كل key بيتحوّل لرقم slot من 16384، وكل master شايل جزء من الـ slots
for (const k of ["user:7", "user:8", "cart:7"]) {
  console.log(k, "← slot", await cluster.cluster("KEYSLOT", k));
}

// أمر على أكتر من key لازم يكونوا في نفس الـ slot
try {
  await cluster.mget("user:7", "cart:7");
} catch (err) {
  console.log("MGET على slots مختلفة:", err.message.split(":")[0]);
}

// hash tag: الجزء اللي بين {} هو اللي بيتحسب منه الـ slot
console.log("{user:7}:profile ← slot", await cluster.cluster("KEYSLOT", "{user:7}:profile"));
console.log("{user:7}:cart    ← slot", await cluster.cluster("KEYSLOT", "{user:7}:cart"));
await cluster.mset("{user:7}:profile", "mona", "{user:7}:cart", "3 items");
console.log("MGET بالـ hash tag:", await cluster.mget("{user:7}:profile", "{user:7}:cart"));
cluster.disconnect();

$ bash cluster.sh && node main.js; bash cluster.sh down
127.0.0.1:7001 ← 0 keys | 5461 slots | 0 slaves.
127.0.0.1:7003 ← 0 keys | 5461 slots | 0 slaves.
127.0.0.1:7002 ← 0 keys | 5462 slots | 0 slaves.
user:7 ← slot 2780
user:8 ← slot 15155
cart:7 ← slot 9546
MGET على slots مختلفة: CROSSSLOT Keys in request don't hash to the same slot
{user:7}:profile ← slot 2780
{user:7}:cart    ← slot 2780
MGET بالـ hash tag: [ 'mona', '3 items' ]

import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL);
await redis.flushall();
await redis.config("SET", "slowlog-log-slower-than", "1000"); // أي أمر أبطأ من 1ms

// شوية traffic: hits و misses وأمر بطيء
for (let i = 0; i < 50; i++) await redis.set(`cache:${i}`, "x".repeat(100));
for (let i = 0; i < 80; i++) await redis.get(`cache:${i}`); // 50 hit و 30 miss
for (let b = 0; b < 20; b++) {
  await redis.rpush("big:list", ...Array.from({ length: 10000 }, (_, i) => String(b * 10000 + i)));
}
await redis.lrange("big:list", 0, -1); // أمر بطيء: بيرجّع 200 ألف حاجة

const info = await redis.info("stats");
const stat = (name) => Number(info.match(new RegExp(`${name}:(\\d+)`))[1]);
const hits = stat("keyspace_hits");
const misses = stat("keyspace_misses");
console.log("hit ratio:", Math.round((100 * hits) / (hits + misses)) + "%");

const mem = await redis.info("memory");
console.log("used_memory > 1MB:", Number(mem.match(/used_memory:(\d+)/)[1]) > 1024 * 1024);

const slow = await redis.slowlog("GET", 5);
console.log("slowlog:", slow.map((e) => e[3].slice(0, 2).join(" ")));

// أكبر key (زي redis-cli --bigkeys بس لـ key واحد)
console.log("big:list:", Math.round((await redis.memory("USAGE", "big:list", "SAMPLES", "0")) / 1024), "KB");
console.log("clients:", (await redis.client("LIST")).trim().split("\n").length);
redis.disconnect();

$ node main.js
hit ratio: 63%
used_memory > 1MB: true
slowlog: [
  'lrange big:list',
  'rpush big:list',
  'rpush big:list',
  'rpush big:list'
]
big:list: 950 KB
clients: 1

import Redis from "ioredis";

const admin = new Redis(process.env.REDIS_URL);
await admin.flushall();
const as = (username, password) => new Redis({ host: "localhost", port: 6379, username, password, enableReadyCheck: false });
const tryIt = async (label, fn) => {
  try { console.log(label.padEnd(32), "→ ok", await fn()); }
  catch (err) { console.log(label.padEnd(32), "→", err.message.split(":")[0]); }
};


await admin.acl("SETUSER", "api", "reset", "on", ">api-pass", "~cache:*", "~sess:*", "+@read", "+@write", "-@dangerous");
await admin.acl("SETUSER", "worker", "reset", "on", ">worker-pass", "~queue:*", "+@list", "+ping");
await admin.acl("SETUSER", "metrics", "reset", "on", ">metrics-pass", "+info", "+slowlog", "+ping");

const api = as("api", "api-pass");
const worker = as("worker", "worker-pass");
const metrics = as("metrics", "metrics-pass");

await tryIt("api SET sess:7", () => api.set("sess:7", "data"));
await tryIt("api GET queue:jobs", () => api.get("queue:jobs"));
await tryIt("api FLUSHDB", () => api.flushdb());
await tryIt("worker LPUSH queue:jobs", () => worker.lpush("queue:jobs", "job1"));
await tryIt("worker SET queue:x", () => worker.set("queue:x", "1"));
await tryIt("worker LPUSH cache:a", () => worker.lpush("cache:a", "1"));
await tryIt("metrics INFO", async () => (await metrics.info("server")).includes("redis_version"));
await tryIt("metrics GET cache:a", () => metrics.get("cache:a"));

// الـ admin شايف كل connection والـ user بتاعها
const users = (await admin.client("LIST")).match(/user=\w+/g);
console.log("connections:", [...new Set(users)].sort().join(" "));
for (const c of [admin, api, worker, metrics]) c.disconnect();

$ node main.js
api SET sess:7                   → ok OK
api GET queue:jobs               → NOPERM this user has no permissions to access one of the keys used as arguments
api FLUSHDB                      → NOPERM this user has no permissions to run the 'flushdb' command or its subcommand
worker LPUSH queue:jobs          → ok 1
worker SET queue:x               → NOPERM this user has no permissions to run the 'set' command or its subcommand
worker LPUSH cache:a             → NOPERM this user has no permissions to access one of the keys used as arguments
metrics INFO                     → ok true
metrics GET cache:a              → NOPERM this user has no permissions to run the 'get' command or its subcommand
connections: user=api user=default user=metrics user=worker

#!/bin/bash
# 3 masters على 7001..7003 (في الإنتاج: كل master معاه replica)
if [ "$1" = "down" ]; then
  for p in 7001 7002 7003; do redis-cli -p $p SHUTDOWN NOSAVE > /dev/null 2>&1 || true; done
  exit 0
fi
rm -rf cluster && mkdir cluster
for p in 7001 7002 7003; do
  redis-server --port $p --cluster-enabled yes --cluster-config-file nodes-$p.conf \
    --dir cluster --save "" --appendonly no --daemonize yes --logfile "$PWD/cluster/$p.log"
done
sleep 0.5
redis-cli --cluster create 127.0.0.1:7001 127.0.0.1:7002 127.0.0.1:7003 --cluster-yes > cluster/create.log
until redis-cli -p 7001 CLUSTER INFO | grep -q 'cluster_state:ok'; do sleep 0.1; done
redis-cli --cluster check 127.0.0.1:7001 | grep -E '^127' | sed 's/ (.*) -> / ← /'