WIUNIX ACADEMY
Set up Redis Sentinel high availability on Ubuntu and Debian
Page 6 of 7. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment5 editable values
LET’S BUILD
Export and verify the backup
Root Bash on current primary. Enter ADMIN at each hidden prompt. Commands run in a fail-closed subshell; an error leaves the partial protected directory for diagnosis and must abort retirement/recovery work. Compare the marker before taking the snapshot; writers remain paused throughout. The archive retains relative paths from the filesystem root.
(
set -euo pipefail
umask 077
install -d -m 0700 /root/academy-backups
backup=$(mktemp -d /root/academy-backups/redis-data-XXXXXXXX)
redis-cli --tls --cacert /etc/redis/tls/ca.pem --cert /etc/redis/tls/node.pem --key /etc/redis/tls/node.key -h 127.0.0.1 --user admin --askpass --raw GET academy:probe > "$backup/probe.txt"
case "$(cat "$backup/probe.txt")" in
before-failover|after-failover) ;;
*) echo "Unexpected lab marker: STOP" >&2; exit 1 ;;
esac
redis-cli --tls --cacert /etc/redis/tls/ca.pem --cert /etc/redis/tls/node.pem --key /etc/redis/tls/node.key -h 127.0.0.1 --user admin --askpass --rdb "$backup/dump.rdb"
test -s "$backup/dump.rdb"
redis-check-rdb "$backup/dump.rdb"
tar -C / -cpf "$backup/config.tar" etc/redis
tar -tf "$backup/config.tar" >/dev/null
tar -C / -df "$backup/config.tar"
cd "$backup"
sha256sum dump.rdb probe.txt config.tar > SHA256SUMS
sha256sum -c SHA256SUMS
printf 'Protected backup: %s\n' "$backup"
)
exit
The RDB passes its checksum/parser check, configuration archive matches source and every backup file has a checked checksum.
LET’S BUILD
Restore into an isolated scratch instance before relying on it
Before the failover rehearsal, on a SEPARATE recovery host with the same Redis version and a protected copy of the backup. Set backup to that actual directory. This uses a new empty path and a private network namespace with no TCP listener; it never points at the original data directory. Root is required for unshare. Do not extract old configs/secrets over a running system. Exact marker equality is one lab integrity check; real recovery needs your representative keys, expiry expectations and application invariants. AOF is deliberately disabled so the restored RDB is loaded instead of an unrelated AOF.
sudo unshare --net --fork bash -eu <<'RESTORE'
umask 077
backup=/root/academy-backups/REPLACE_WITH_VERIFIED_BACKUP_DIRECTORY
cd "$backup"
sha256sum -c SHA256SUMS
redis-check-rdb dump.rdb
restore=$(mktemp -d /root/redis-restore-XXXXXXXX)
install -m 0600 dump.rdb "$restore/dump.rdb"
redis-server --bind 127.0.0.1 --port 0 --unixsocket "$restore/redis.sock" --unixsocketperm 600 --dir "$restore" --dbfilename dump.rdb --appendonly no --save '' --daemonize yes --pidfile "$restore/redis.pid" --logfile "$restore/redis.log"
trap 'redis-cli -s "$restore/redis.sock" SHUTDOWN NOSAVE >/dev/null || true' EXIT
for attempt in $(seq 1 30); do
if test -S "$restore/redis.sock"; then break; fi
sleep 1
done
actual=$(redis-cli -s "$restore/redis.sock" --raw GET academy:probe)
expected=$(cat "$backup/probe.txt")
test -n "$expected"
test "$actual" = "$expected"
redis-cli -s "$restore/redis.sock" DBSIZE
redis-cli -s "$restore/redis.sock" INFO persistence
printf 'Isolated marker restore passed; retained at %s\n' "$restore"
RESTORE
Checksum, RDB load and exact marker equality pass; scratch process is shut down and retained data is not deleted. Any error aborts reliance on the backup.
Rehearse only with application traffic fenced
The following stop/start panels belong ONLY to these disposable dedicated tutorial nodes, never production. Pause the lab writer and prevent every client from reaching A’s data port using your existing lab network control before the stop; retain admin/Sentinel connectivity. Stopping Redis alone is not a fencing design for a partitioned live primary. Confirm backups and data checks first. If A is already not the discovered primary, stop here and use its actual role instead of blindly following the bootstrap address. Never promote two nodes manually or restart the old primary from a stale bootstrap file.
LET’S BUILD
Simulate loss of the dedicated lab primary
On A ONLY, after discovery confirms it is still primary, B/C have the marker and the lab client path to A is fenced. A’s Sentinel remains running. This is a controlled service-loss rehearsal, not a test of physical host/failure-domain loss.
sudo systemctl stop redis-server
sudo systemctl is-active redis-server
The lab data service is inactive (is-active intentionally returns nonzero); Sentinel remains available.
LET’S BUILD
Observe election and the new primary
On B/C use the earlier Sentinel maintenance login and this session. Within a bounded 180 s observation window expect an address DIFFERENT from A, CKQUORUM OK and converged master state across voters. If no promotion occurs, use diagnostics; do not weaken quorum or repeatedly force failover. Timing depends on actual health and election state.
SENTINEL GET-MASTER-ADDR-BY-NAME academy
SENTINEL CKQUORUM academy
SENTINEL MASTER academy
QUIT
Check the role, exact values and required responses described above; stop on any unexpected result.
LET’S BUILD
Connect to the discovered primary, not a guessed address
On the approved client, replace DISCOVERED_PRIMARY_IP with the just-returned B or C address. APP secret at the prompt. The other surviving data node must have rejoined as its replica before the min-replicas policy permits writes. Run the next session on this same connection.
redis-cli --tls --cacert /etc/academy-client/ca.pem --cert /etc/academy-client/client.pem --key /etc/academy-client/client.key -h DISCOVERED_PRIMARY_IP -p 6379 --user app --askpass
The approved client reaches the discovered endpoint over mutual TLS.