hi, how do i set a username and password for redis? the system will not allow me to access containers with docker exec Fleet_Redis /bin/bash

Greetings, There should be environment variables exposed

FLEET_REDIS_USERNAME

FLEET_REDIS_PASSWORD

https://fleetdm.com/docs/configuration/fleet-server-configuration#redis

thanks @Grant Bilstad can you specify better? i am now running fleet with this docker-compose, but redis is exposed and vulnerable, how do i protect it?

version: '3.9'
services:
  redis:
    restart: always
    container_name: Fleet_Redis
    image: redis:5
    ports:
      - "6379:6379"
    networks:
      - Proxy

  fleetdm:
    restart: always
    container_name: Fleet
    image: fleetdm/fleet:v4.38.0
    volumes:
      - /data/docker/appdata/fleet:/fleet
      - /data/docker/logs/fleet:/var/log/fleet
    command: sh -c "echo '\n' | /usr/bin/fleet prepare db && /usr/bin/fleet serve"
    #ports:
    #  - "8081:8080"
    environment:
      FLEET_MYSQL_ADDRESS: 172*******:3306
      FLEET_MYSQL_DATABASE: fleet
      FLEET_MYSQL_USERNAME: app
      FLEET_MYSQL_PASSWORD: **************
      FLEET_REDIS_ADDRESS: redis:6379
      FLEET_SERVER_CERT: /fleet/itl.crt
      FLEET_SERVER_KEY: /fleet/itl-cs.key
      FLEET_LOGGING_JSON: "true"
      FLEET_AUTH_JWT_KEY:
      FLEET_ACTIVITY_ENABLE_AUDIT_LOG: "true"
      FLEET_ACTIVITY_AUDIT_LOG_PLUGIN: filesystem
      FLEET_FILESYSTEM_AUDIT_LOG_FILE: /var/log/fleet/audit.log
      FLEET_OSQUERY_STATUS_LOG_PLUGIN: filesystem
      FLEET_FILESYSTEM_STATUS_LOG_FILE: /var/log/fleet/osqueryd.status.log
      FLEET_OSQUERY_RESULT_LOG_PLUGIN: filesystem
      FLEET_FILESYSTEM_RESULT_LOG_FILE: /var/log/fleet/osqueryd.results.log
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.fleetdm.rule=HostSNI(`*`)"  # Use HostSNI to match any SNI
      - "traefik.tcp.routers.fleetdm.entrypoints=websecure"  # Use your desired entry point, 'websecure' may be your secure HTTPS entry point
      - "traefik.tcp.services.fleetdm.loadbalancer.server.port=8080"  # Replace 8080 with the appropriate port on which your service listens
    networks:
      - Proxy

networks:
  Proxy:
    external: true

This is more of a Redis support type question, trying to help as much as I can for your setup. I'd follow these to try to get your Redis secured. https://copyprogramming.com/howto/how-to-use-redis-username-with-password-in-docker-compose https://nickjanetakis.com/blog/docker-tip-27-setting-a-password-on-redis-without-a-custom-config Make sure to add correct flags under fleet section of compose

FLEET_REDIS_USERNAME

FLEET_REDIS_PASSWORD

For Redis infrastructure is recommended that you not expose directly to the internet. Some hosting services setup their Redis as "external" and will want to make sure to secure the connection between the server and the proxy with TLS, certs, or ACL. Here is some documentation from Redis to help securing your infrastructure https://redis.io/docs/management/security/

ok, but in this case there is no username, all the guides indicate only the password; so it will be FLEET_REDIS_USERNAME = null FLEET_REDIS_PASSWORD = password ?

Would need to set in docker-compose for both Redis and Fleet to same, or in the

redis.conf

requirepass <password>

. Redis says that they do prefer if leverage ACL from one of the previous docs linked, if exposed to public internet https://redis.io/docs/management/security/acl/ By default (and suggested) Redis is in 'Protected Mode' meaning they bind only to loopback interface internally (as Redis is talking only with Fleet)