immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

It is not possible to use REDIS_URL in a secure way #7975

New Issue
Closed
opened 2026-02-05 13:26:45 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-05 13:26:45 +03:00
Owner
Copy Link

Originally created by @shimisnow on GitHub (Dec 2, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

This is not a application bug, but can be seen as a deployment one. The nature of this is not a security risk.

Per the documentation here, when REDIS_URL is used, REDIS_USERNAME and REDIS_PASSWORD variables are ignored, but REDIS_URL cannot be used as secret.

When using ioredis://<base64> to pass the information:

{
  "host": "immich-cache.internal-network",
  "port": 6379,
  "username": "immu",
  "password": "123",
  "tls": {
    "ca": "/certs/ca.crt",
    "rejectUnauthorized": false
 }
}

it works, but then we have the problem that the credentials are exposed as envs.

It appears that the only change needed is in the start.sh

...
read_file_and_export "REDIS_PASSWORD_FILE" "REDIS_PASSWORD"

if CPU_CORES="${CPU_CORES:=$(get-cpus.sh 2>/dev/null)}"; then
...

to add read_file_and_export "REDIS_URL_FILE" "REDIS_URL"

If it is something that makes sense to add, I am willing to open a PR to change the code and the docs

The OS that Immich Server is running on

Docker

Version of Immich Server

v2.3.1

Version of Immich Mobile App

Not apply

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

No response

Your docker-compose.yml content

services:
  immich-server:
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    depends_on:
      immich-cache:
        condition: service_healthy
      immich-database:
        condition: service_healthy
    environment:
      LOG_LEVEL: warn
      DB_URL_FILE: /run/secrets/IMMICH_DATABASE_URL
      REDIS_URL: "ioredis://ewogIC..."
    networks:
      - internal-network
    expose:
      - "2283"
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    secrets:
      - IMMICH_DATABASE_URL
    restart: unless-stopped

Your .env content

Not apply

Reproduction steps

  1. Deploy the immich container with REDIS_URL using ioredis url
  2. REDIS_URL will be exposed as it cannot be a secret

Relevant log output

Additional information

No response

Originally created by @shimisnow on GitHub (Dec 2, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [ ] Yes ### The bug This is not a application bug, but can be seen as a deployment one. The nature of this is not a security risk. Per the documentation [here](https://docs.immich.app/install/environment-variables/), when `REDIS_URL` is used, `REDIS_USERNAME` and `REDIS_PASSWORD` variables are ignored, but `REDIS_URL` cannot be used as [secret](https://docs.immich.app/install/environment-variables/#secrets). When using ` ioredis://<base64>` to pass the information: ```json { "host": "immich-cache.internal-network", "port": 6379, "username": "immu", "password": "123", "tls": { "ca": "/certs/ca.crt", "rejectUnauthorized": false } } ``` it works, but then we have the problem that the credentials are exposed as envs. It appears that the only change needed is in the [start.sh](https://github.com/immich-app/immich/blob/main/server/bin/start.sh) ```bash ... read_file_and_export "REDIS_PASSWORD_FILE" "REDIS_PASSWORD" if CPU_CORES="${CPU_CORES:=$(get-cpus.sh 2>/dev/null)}"; then ... ``` to add `read_file_and_export "REDIS_URL_FILE" "REDIS_URL"` If it is something that makes sense to add, I am willing to open a PR to change the code and the docs ### The OS that Immich Server is running on Docker ### Version of Immich Server v2.3.1 ### Version of Immich Mobile App Not apply ### Platform with the issue - [x] Server - [ ] Web - [ ] Mobile ### Device make and model _No response_ ### Your docker-compose.yml content ```YAML services: immich-server: image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} depends_on: immich-cache: condition: service_healthy immich-database: condition: service_healthy environment: LOG_LEVEL: warn DB_URL_FILE: /run/secrets/IMMICH_DATABASE_URL REDIS_URL: "ioredis://ewogIC..." networks: - internal-network expose: - "2283" volumes: - ${UPLOAD_LOCATION}:/data - /etc/localtime:/etc/localtime:ro secrets: - IMMICH_DATABASE_URL restart: unless-stopped ``` ### Your .env content ```Shell Not apply ``` ### Reproduction steps 1. Deploy the immich container with REDIS_URL using ioredis url 2. REDIS_URL will be exposed as it cannot be a secret ### Relevant log output ```shell ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 13:26:47 +03:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 2, 2025):

This issue has automatically been closed as it is likely a duplicate. We get a lot of duplicate threads each day, which is why we ask you in the template to confirm that you searched for duplicates before opening one. If you're sure this is not a duplicate, please leave a comment and we will reopen the thread if necessary.

@github-actions[bot] commented on GitHub (Dec 2, 2025): This issue has automatically been closed as it is likely a duplicate. We get a lot of duplicate threads each day, which is why we ask you in the template to confirm that you searched for duplicates before opening one. If you're sure this is not a duplicate, please leave a comment and we will reopen the thread if necessary.
OVERLORD commented 2026-02-05 13:26:48 +03:00
Author
Owner
Copy Link

@shimisnow commented on GitHub (Dec 28, 2025):

I am sure this is not a duplicate. Been using the provided code to add the secret since v2.3.1 without problems.

@shimisnow commented on GitHub (Dec 28, 2025): I am sure this is not a duplicate. Been using the provided code to add the secret since v2.3.1 without problems.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7975
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?