WIUNIX ACADEMY
Set up Redis Sentinel high availability on Ubuntu and Debian
Page 3 of 7. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment5 editable values
LET’S BUILD
Prepare Sentinel ACL identities
On all three nodes. The next file separates privileged peer/admin access from client discovery. PEER is intentionally a Sentinel superuser per the upstream contract; never distribute it to applications. No requirepass is combined with ACL mode.
sudo install -o root -g redis -m 0640 /dev/null /etc/redis/sentinel-users.acl
sudo nano /etc/redis/sentinel-users.acl
The separate protected ACL file is ready.
Sentinel ACL file contents
Same roles/secrets on A/B/C. DISCOVERY cannot request a failover or change Sentinel settings. ADMIN secret here matches the chosen maintenance identity; PEER remains separate from Redis CONTROL.
user default off
user admin on >REPLACE_ADMIN_64_HEX allchannels +@all
user peer on >REPLACE_PEER_64_HEX allchannels +@all
user discovery on >REPLACE_DISCOVERY_64_HEX -@all +auth +client|getname +client|id +client|setname +command +hello +ping +role +sentinel|get-master-addr-by-name +sentinel|master +sentinel|myid +sentinel|replicas +sentinel|sentinels +sentinel|masters
LET’S BUILD
Edit Sentinel on each node
Replace the dedicated Sentinel file with the next panel. Change BOTH bind and sentinel announce-ip to the local node IP on B/C. Initial monitored primary remains A on all three. CONTROL matches Redis ACL; PEER matches Sentinel ACL. This file and its parent directory must support atomic rewrites; do not make them read-only or restore the bootstrap copy after an election.
sudo nano /etc/redis/sentinel.conf
Each voter has a unique reachable announce IP and the same group/authentication settings.
Sentinel file contents
The detection interval is 10 s, not a recovery SLA. Leader election, replica selection, synchronization and application reconnection add time. parallel-syncs 1 limits simultaneous replica resynchronization. TLS covers voter links and monitored Redis connections because tls-replication is enabled.
bind 127.0.0.1 10.20.0.10
protected-mode yes
port 0
tls-port 26379
tls-cert-file /etc/redis/tls/node.pem
tls-key-file /etc/redis/tls/node.key
tls-ca-cert-file /etc/redis/tls/ca.pem
tls-auth-clients yes
tls-protocols "TLSv1.2 TLSv1.3"
tls-replication yes
daemonize no
supervised systemd
pidfile /run/sentinel/redis-sentinel.pid
logfile /var/log/redis/redis-sentinel.log
dir /var/lib/redis
aclfile /etc/redis/sentinel-users.acl
sentinel announce-ip 10.20.0.10
sentinel announce-port 26379
sentinel monitor academy 10.20.0.10 6379 2
sentinel auth-user academy control
sentinel auth-pass academy REPLACE_CONTROL_64_HEX
sentinel sentinel-user peer
sentinel sentinel-pass REPLACE_PEER_64_HEX
sentinel down-after-milliseconds academy 10000
sentinel failover-timeout academy 180000
sentinel parallel-syncs academy 1
LET’S BUILD
Check permissions and reject unfilled placeholders
On A/B/C before starting. The redis account owns the two rewriteable configs; ACL files stay root-owned. The directory is trusted runtime configuration, not a Git deployment target. The service sandbox must allow writes here; inspect native units rather than disabling their hardening. Do not print secret-bearing files.
(
set -euo pipefail
sudo chown redis:redis /etc/redis /etc/redis/redis.conf /etc/redis/sentinel.conf
sudo chmod 0750 /etc/redis
sudo chmod 0640 /etc/redis/redis.conf /etc/redis/sentinel.conf
sudo chown root:redis /etc/redis/users.acl /etc/redis/sentinel-users.acl
sudo chmod 0640 /etc/redis/users.acl /etc/redis/sentinel-users.acl
if sudo grep -E 'REPLACE_' /etc/redis/redis.conf /etc/redis/sentinel.conf /etc/redis/users.acl /etc/redis/sentinel-users.acl >/dev/null; then
echo 'Unfilled secret placeholder: STOP' >&2; exit 1
else
status=$?
test "$status" -eq 1
fi
sudo -u redis test -w /etc/redis
sudo -u redis test -w /etc/redis/redis.conf
sudo -u redis test -w /etc/redis/sentinel.conf
systemctl show redis-server redis-sentinel -p User -p Group -p ExecStart -p ReadWritePaths -p ReadWriteDirectories -p RuntimeDirectory
sudo ss -lntp
)
No placeholder remains; configs can be rewritten and unit paths agree with this selected package.
LET’S BUILD
Start only the three dedicated Redis instances
On A first, then B and C. This is the first start with the new configuration. Confirm only TLS 6379 listens on loopback and the intended private IP. Inspect a failed start before retrying; Redis has no general-purpose offline config-test flag equivalent to nginx -t.
sudo systemctl enable --now redis-server
sudo systemctl status redis-server --no-pager
sudo ss -lntp
All three Redis services are active, with no plaintext or public listener.