WIUNIX ACADEMY
Set up Redis Sentinel high availability on Ubuntu and Debian
Build one active Redis primary, two passive replicas and three independent Sentinel voters. Verify replication, discovery, controlled failover and safe recovery.
Make this guide yoursYOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment5 editable values
THE OUTCOME
What will you have at the end?
A three-node Redis/Sentinel group with mutual TLS, separate ACL identities, proven receiver data, controlled service failover and a data-preserving recovery path.
Supported operating systems and versions
Reviewed 2026-10-20. Five distro paths are documentation-reviewed, not full installations. Existing Redis 7.0.15 ran three real data nodes and three Sentinels in one isolated network namespace: mutual TLS/ACLs, exact receiver data, service-loss election, post-failover data, rejoin, persistent config rewrite, RDB export/restore and write blocking without replicas. This same-host simulation does not prove independent failure domains, host/systemd/firewall/actual application-library/all-OS deployment. Upstream/distro support differ. Fictional DEMO photographs.
Before you begin
- Three fresh systemd hosts on one reviewed OS/package version; existing sudo/SSH, assigned private IPs, synchronized clocks and independent failure domains.
- Existing default-deny network policy, an approved client host, a protected secret manager and an existing deployment-specific CA with unique dual-purpose node certificates plus independent client certificate.
- No existing Redis/Valkey data or application writers; enough RAM/disk for persistence and backups. Backup/recovery host has same-version Redis and root network-namespace capability.
One active writer, two passive copies
Use three dedicated fresh hosts: A 10.20.0.10, B 10.20.0.11 and C 10.20.0.12. Each runs Redis on TLS 6379 and Sentinel on TLS 26379. A starts as primary; B and C start as read-only replicas. The group name academy stays stable as the primary changes. Put the three Sentinel voters in three independent failure domains: three processes on one machine, or three VMs on one hypervisor, do not provide three independent domains. This is a single dataset, not Redis Cluster sharding or active-active writes.
Quorum, majority and the cost of availability
Quorum 2 means two Sentinels must report the primary down before objective-down detection. A failover leader also needs authorization from a majority of all known Sentinels: two of three in this topology. One surviving voter cannot promote safely. Replication is asynchronous: acknowledged writes can disappear after promotion, and replicas can return stale reads. WAIT measures replica acknowledgements on the same connection; it does not turn Sentinel into a consensus database or guarantee durable commits. AOF everysec may lose recent local writes on a crash. Sentinel is neither fencing nor a backup.
Fresh hosts only; settle trust and routing first
Do not run this initialization against an existing installation or dataset. Stop when a guard finds state; never delete it to pass. Use the same selected OS and exact current distro package version on all three hosts. Example addresses and interface ens 18 must be replaced consistently. Use an existing default-deny firewall/security group: permit 6379 only among A/B/C and the approved application/admin IPs; permit 26379 only among A/B/C and approved discovery/admin clients. Keep SSH restricted through its existing rule. Do not expose either port publicly or use NAT port remapping. Configure those existing network controls before starting services; this guide does not replace your firewall policy.
Upstream releases, distro maintenance and licensing
Reviewed 2026-10-20: the upstream Open Source release index lists 8.10, while selected distro baselines are 8.0 or 7.0. Upstream security policy does not support 8.0/7.0; patched distribution packages have a separate maintenance decision. This guide is conditional on verified distro security coverage, not a recommendation to run an unmaintained binary. Check the package security tracker and repository origin before production. The 7.0 baseline uses BSD-3-Clause; Redis 8 offers AGPLv 3, RSALv 2 or SSPLv 1. Inspect the installed package copyright and the chosen license obligations, especially for modified or hosted distribution; do not assume Cloud/Software terms apply. No module stack is installed here.
LET’S BUILD
Inspect all three fresh nodes
On A/B/C in Bash as the existing sudo administrator. Confirm the selected OS, assigned private IP, clock synchronization, at least 2 GB RAM and space for three data copies, AOF rewrites and retained backups. Investigate any listener on 6379/26379. An unregistered manually installed server can escape the package check: inspect running processes/listeners too.
(
set -euo pipefail
. /etc/os-release
printf '%s %s\n' "$ID" "$VERSION_ID"
dpkg --print-architecture
ip -br address
timedatectl status
df -h / /var
installed=$(dpkg-query -W -f='${binary:Package} ${db:Status-Status}\n')
if printf '%s\n' "$installed" | grep -E '^(redis-server|redis-sentinel|valkey-server|valkey-sentinel)(:[^ ]+)? installed$' >/dev/null; then
echo 'Existing Redis/Valkey installation: STOP' >&2; exit 1
fi
for path in /etc/redis /var/lib/redis /var/lib/redis-sentinel; do
if sudo test -e "$path"; then echo "Existing state: $path; STOP" >&2; exit 1; fi
done
sudo ss -lntp
)
All nodes are fresh and the selected private network is assigned.
LET’S BUILD
Install matching distribution packages
On A/B/C only after the fresh-host guard. APT verifies signed repository metadata and package hashes; use this OS release’s own repositories and current security updates. Do not substitute an upstream tarball, Valkey binary or another Ubuntu release repository. Package installation may start a loopback-only service. The next panel stops only these newly installed dedicated tutorial services before configuring them. Compare full package versions across all nodes.
sudo apt-get update
sudo apt-get install redis-server redis-sentinel redis-tools openssl nano
dpkg-query -W redis-server redis-sentinel redis-tools
redis-server --version
redis-sentinel --version
redis-cli --version
Redis and Sentinel versions match on all three nodes; no unauthenticated package source is used.