Problem connecting to redis cluster with password-protected sentinels

[mazminovad]

Application

Shlink

Application version

4.6

How do you serve the application

Other (explain in summary)

Database engine (if any)

PostgreSQL

Database version

15

Summary

When upgrading shlink from 4.5 to 4.6, there was a problem connecting to redis-sentinel when running migrations.

The documentation states that if we want to use redis-sentinel for shlink, we need to add new variables:

REDIS_SERVERS: A comma-separated list of redis servers which Shlink uses for shared locks, cache, and optionally real-time updates through pub/sub (make sure to include the port number and credentials for every server).

REDIS_SENTINEL_SERVICE: The name of the sentinel service if you want to use redis sentinel. If this value is provided, the servers provided in REDIS_SERVERS will be considered sentinel instances.

REDIS_SERVERS_USER (v4.6.0) : The user credential for redis server/s. Ignored when not using REDIS_SENTINEL_SERVICE.

REDIS_SERVERS_PASSWORD (v4.6.0) : The password credential for redis server/s. Ignored when not using REDIS_SENTINEL_SERVICE.

REDIS_PUB_SUB_ENABLED: Tells if the configured redis instance/cluster should also be used to publish real-time updates via redis pub/sub. Defaults to false.

All variables were added to env, but i shlink does not want to authenticate to sentinel using the password

Here is a log:

  ERR  [2026-01-21T05:47:51.301158+00:00] [-] Shlink.NOTICE - Failed to acquire the "Shlink:db:create" lock.
  ERR  In Lock.php line 116:
  ERR                                                               
  ERR    [Symfony\Component\Lock\Exception\LockAcquiringException]  
  ERR    Failed to acquire the "Shlink:db:create" lock.             
  ERR                                                               
  ERR  
  ERR  Exception trace:
  ERR    at /etc/shlink/vendor/symfony/lock/Lock.php:116
  ERR   Symfony\Component\Lock\Lock->acquire() at /etc/shlink/module/CLI/src/Command/Util/AbstractLockedCommand.php:26
  ERR   Shlinkio\Shlink\CLI\Command\Util\AbstractLockedCommand->execute() at /etc/shlink/vendor/symfony/console/Command/Command.php:318
  ERR   Symfony\Component\Console\Command\Command->run() at /etc/shlink/vendor/symfony/console/Application.php:1055
  ERR   Symfony\Component\Console\Application->doRunCommand() at /etc/shlink/vendor/symfony/console/Application.php:356
  ERR   Symfony\Component\Console\Application->doRun() at /etc/shlink/vendor/symfony/console/Application.php:195
  ERR   Symfony\Component\Console\Application->run() at /etc/shlink/bin/cli:10
  ERR  
  ERR  In RedisStore.php line 368:
  ERR                                                             
  ERR    [Symfony\Component\Lock\Exception\LockStorageException]  
  ERR    NOAUTH Authentication required.                          
  ERR                                                             
  ERR  
  ERR  Exception trace:
  ERR    at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:368
  ERR   Symfony\Component\Lock\Store\RedisStore->handlePredisError() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:290
  ERR   Symfony\Component\Lock\Store\RedisStore->evaluate() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:332
  ERR   Symfony\Component\Lock\Store\RedisStore->getNowCode() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:62
  ERR   Symfony\Component\Lock\Store\RedisStore->save() at /etc/shlink/vendor/shlinkio/shlink-common/src/Lock/NamespacedStore.php:29
  ERR   Shlinkio\Shlink\Common\Lock\NamespacedStore->save() at /etc/shlink/vendor/symfony/lock/Lock.php:75
  ERR   Symfony\Component\Lock\Lock->acquire() at /etc/shlink/module/CLI/src/Command/Util/AbstractLockedCommand.php:26
  ERR   Shlinkio\Shlink\CLI\Command\Util\AbstractLockedCommand->execute() at /etc/shlink/vendor/symfony/console/Command/Command.php:318
  ERR   Symfony\Component\Console\Command\Command->run() at /etc/shlink/vendor/symfony/console/Application.php:1055
  ERR   Symfony\Component\Console\Application->doRunCommand() at /etc/shlink/vendor/symfony/console/Application.php:356
  ERR   Symfony\Component\Console\Application->doRun() at /etc/shlink/vendor/symfony/console/Application.php:195
  ERR   Symfony\Component\Console\Application->run() at /etc/shlink/bin/cli:10
  ERR  
  ERR  In SentinelReplication.php line 369:
  ERR                                       
  ERR    [Predis\Response\ServerException]  
  ERR    NOAUTH Authentication required.    
  ERR                                       
  ERR  
  ERR  Exception trace:
  ERR    at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:369
  ERR   Predis\Connection\Replication\SentinelReplication->handleSentinelErrorResponse() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:392
  ERR   Predis\Connection\Replication\SentinelReplication->querySentinelForMaster() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:469
  ERR   Predis\Connection\Replication\SentinelReplication->getMaster() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:542
  ERR   Predis\Connection\Replication\SentinelReplication->getConnectionInternal() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:586
  ERR   Predis\Connection\Replication\SentinelReplication->getConnectionByCommand() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:718
  ERR   Predis\Connection\Replication\SentinelReplication->retryCommandOnFailure() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:758
  ERR   Predis\Connection\Replication\SentinelReplication->executeCommand() at /etc/shlink/vendor/predis/predis/src/Client.php:381
  ERR   Predis\Client->executeCommand() at /etc/shlink/vendor/predis/predis/src/Client.php:335
  ERR   Predis\Client->__call() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:290
  ERR   Symfony\Component\Lock\Store\RedisStore->{closure:Symfony\Component\Lock\Store\RedisStore::evaluate():290}() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:366
  ERR   Symfony\Component\Lock\Store\RedisStore->handlePredisError() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:290
  ERR   Symfony\Component\Lock\Store\RedisStore->evaluate() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:332
  ERR   Symfony\Component\Lock\Store\RedisStore->getNowCode() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:62
  ERR   Symfony\Component\Lock\Store\RedisStore->save() at /etc/shlink/vendor/shlinkio/shlink-common/src/Lock/NamespacedStore.php:29
  ERR   Shlinkio\Shlink\Common\Lock\NamespacedStore->save() at /etc/shlink/vendor/symfony/lock/Lock.php:75
  ERR   Symfony\Component\Lock\Lock->acquire() at /etc/shlink/module/CLI/src/Command/Util/AbstractLockedCommand.php:26
  ERR   Shlinkio\Shlink\CLI\Command\Util\AbstractLockedCommand->execute() at /etc/shlink/vendor/symfony/console/Command/Command.php:318
  ERR   Symfony\Component\Console\Command\Command->run() at /etc/shlink/vendor/symfony/console/Application.php:1055
  ERR   Symfony\Component\Console\Application->doRunCommand() at /etc/shlink/vendor/symfony/console/Application.php:356
  ERR   Symfony\Component\Console\Application->doRun() at /etc/shlink/vendor/symfony/console/Application.php:195
  ERR   Symfony\Component\Console\Application->run() at /etc/shlink/bin/cli:10
  ERR  
  ERR  db:create
  ERR  
  ERR  
  RES  1 Command did not run successfully
Updating database... [Running "/usr/local/bin/php bin/cli db:migrate"]   RUN  '/usr/local/bin/php' 'bin/cli' 'db:migrate'
  ERR  [2026-01-21T05:47:51.801709+00:00] [-] Shlink.NOTICE - Failed to acquire the "Shlink:db:migrate" lock.
  ERR  In Lock.php line 116:
  ERR                                                               
  ERR    [Symfony\Component\Lock\Exception\LockAcquiringException]  
  ERR    Failed to acquire the "Shlink:db:migrate" lock.            
  ERR                                                               
  ERR  
  ERR  Exception trace:
  ERR    at /etc/shlink/vendor/symfony/lock/Lock.php:116
  ERR   Symfony\Component\Lock\Lock->acquire() at /etc/shlink/module/CLI/src/Command/Util/AbstractLockedCommand.php:26
  ERR   Shlinkio\Shlink\CLI\Command\Util\AbstractLockedCommand->execute() at /etc/shlink/vendor/symfony/console/Command/Command.php:318
  ERR   Symfony\Component\Console\Command\Command->run() at /etc/shlink/vendor/symfony/console/Application.php:1055
  ERR   Symfony\Component\Console\Application->doRunCommand() at /etc/shlink/vendor/symfony/console/Application.php:356
  ERR   Symfony\Component\Console\Application->doRun() at /etc/shlink/vendor/symfony/console/Application.php:195
  ERR   Symfony\Component\Console\Application->run() at /etc/shlink/bin/cli:10
  ERR  
  ERR  In RedisStore.php line 368:
  ERR                                                             
  ERR    [Symfony\Component\Lock\Exception\LockStorageException]  
  ERR    NOAUTH Authentication required.                          
  ERR                                                             
  ERR  
  ERR  Exception trace:
  ERR    at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:368
  ERR   Symfony\Component\Lock\Store\RedisStore->handlePredisError() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:290
  ERR   Symfony\Component\Lock\Store\RedisStore->evaluate() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:332
  ERR   Symfony\Component\Lock\Store\RedisStore->getNowCode() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:62
  ERR   Symfony\Component\Lock\Store\RedisStore->save() at /etc/shlink/vendor/shlinkio/shlink-common/src/Lock/NamespacedStore.php:29
  ERR   Shlinkio\Shlink\Common\Lock\NamespacedStore->save() at /etc/shlink/vendor/symfony/lock/Lock.php:75
  ERR   Symfony\Component\Lock\Lock->acquire() at /etc/shlink/module/CLI/src/Command/Util/AbstractLockedCommand.php:26
  ERR   Shlinkio\Shlink\CLI\Command\Util\AbstractLockedCommand->execute() at /etc/shlink/vendor/symfony/console/Command/Command.php:318
  ERR   Symfony\Component\Console\Command\Command->run() at /etc/shlink/vendor/symfony/console/Application.php:1055
  ERR   Symfony\Component\Console\Application->doRunCommand() at /etc/shlink/vendor/symfony/console/Application.php:356
  ERR   Symfony\Component\Console\Application->doRun() at /etc/shlink/vendor/symfony/console/Application.php:195
  ERR   Symfony\Component\Console\Application->run() at /etc/shlink/bin/cli:10
  ERR  
  ERR  In SentinelReplication.php line 369:
  ERR                                       
  ERR    [Predis\Response\ServerException]  
  ERR    NOAUTH Authentication required.    
  ERR                                       
  ERR  
  ERR  Exception trace:
  ERR    at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:369
  ERR   Predis\Connection\Replication\SentinelReplication->handleSentinelErrorResponse() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:392
  ERR   Predis\Connection\Replication\SentinelReplication->querySentinelForMaster() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:469
  ERR   Predis\Connection\Replication\SentinelReplication->getMaster() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:542
  ERR   Predis\Connection\Replication\SentinelReplication->getConnectionInternal() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:586
  ERR   Predis\Connection\Replication\SentinelReplication->getConnectionByCommand() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:718
  ERR   Predis\Connection\Replication\SentinelReplication->retryCommandOnFailure() at /etc/shlink/vendor/predis/predis/src/Connection/Replication/SentinelReplication.php:758
  ERR   Predis\Connection\Replication\SentinelReplication->executeCommand() at /etc/shlink/vendor/predis/predis/src/Client.php:381
  ERR   Predis\Client->executeCommand() at /etc/shlink/vendor/predis/predis/src/Client.php:335
  ERR   Predis\Client->__call() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:290
  ERR   Symfony\Component\Lock\Store\RedisStore->{closure:Symfony\Component\Lock\Store\RedisStore::evaluate():290}() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:366
  ERR   Symfony\Component\Lock\Store\RedisStore->handlePredisError() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:290
  ERR   Symfony\Component\Lock\Store\RedisStore->evaluate() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:332
  ERR   Symfony\Component\Lock\Store\RedisStore->getNowCode() at /etc/shlink/vendor/symfony/lock/Store/RedisStore.php:62
  ERR   Symfony\Component\Lock\Store\RedisStore->save() at /etc/shlink/vendor/shlinkio/shlink-common/src/Lock/NamespacedStore.php:29
  ERR   Shlinkio\Shlink\Common\Lock\NamespacedStore->save() at /etc/shlink/vendor/symfony/lock/Lock.php:75
  ERR   Symfony\Component\Lock\Lock->acquire() at /etc/shlink/module/CLI/src/Command/Util/AbstractLockedCommand.php:26
  ERR   Shlinkio\Shlink\CLI\Command\Util\AbstractLockedCommand->execute() at /etc/shlink/vendor/symfony/console/Command/Command.php:318
  ERR   Symfony\Component\Console\Command\Command->run() at /etc/shlink/vendor/symfony/console/Application.php:1055
  ERR   Symfony\Component\Console\Application->doRunCommand() at /etc/shlink/vendor/symfony/console/Application.php:356
  ERR   Symfony\Component\Console\Application->doRun() at /etc/shlink/vendor/symfony/console/Application.php:195
  ERR   Symfony\Component\Console\Application->run() at /etc/shlink/bin/cli:10
  ERR  
  ERR  db:migrate
  ERR  
  ERR  
  RES  1 Command did not run successfully
Generating proxies... [Running "/usr/local/bin/php bin/doctrine orm:generate-proxies"]   RUN  '/usr/local/bin/php' 'bin/doctrine' 'orm:generate-proxies'
  ERR   Processing entity "Shlinkio\Shlink\Core\Visit\Entity\VisitLocation"
  ERR   Processing entity "Shlinkio\Shlink\Core\Visit\Entity\Visit"
  ERR   Processing entity "Shlinkio\Shlink\Core\Tag\Entity\Tag"
  ERR   Processing entity "Shlinkio\Shlink\Core\RedirectRule\Entity\ShortUrlRedirectRule"
  ERR   Processing entity "Shlinkio\Shlink\Core\Visit\Entity\OrphanVisitsCount"
  ERR   Processing entity "Shlinkio\Shlink\Core\Geolocation\Entity\GeolocationDbUpdate"
  ERR   Processing entity "Shlinkio\Shlink\Core\ShortUrl\Entity\ShortUrl"
  ERR   Processing entity "Shlinkio\Shlink\Core\RedirectRule\Entity\RedirectCondition"
  ERR   Processing entity "Shlinkio\Shlink\Core\Domain\Entity\Domain"
  ERR   Processing entity "Shlinkio\Shlink\Core\Visit\Entity\ShortUrlVisitsCount"
  ERR   Processing entity "Shlinkio\Shlink\Rest\Entity\ApiKey"
  ERR   Processing entity "Shlinkio\Shlink\Rest\Entity\ApiKeyRole"
  ERR  
  ERR   Proxy classes generated to "/etc/shlink/data/proxies"
  ERR  
  RES  Command ran successfully
 Success!
Clearing entities cache... [Running "/usr/local/bin/php bin/doctrine orm:clear-cache:metadata"]   RUN  '/usr/local/bin/php' 'bin/doctrine' 'orm:clear-cache:metadata'
  ERR  
  ERR   // Clearing all Metadata cache entries                                         
  ERR  
  ERR   [OK] No cache entries were deleted.                                            
  ERR  
  ERR  
  RES  Command ran successfully
 Success!
Creating first API key... [Running "/usr/local/bin/php bin/cli api-key:initial fb0001d5-c472-4fbd-8398-b6ef4d716ee0"]   RUN  '/usr/local/bin/php' 'bin/cli' 'api-key:initial' 'fb0001d5-c472-4fbd-8398-b6ef4d716ee0'
  OUT  Other API keys already exist. Initial API key creation skipped.
  OUT  
  RES  Command ran successfully```

A similar problem was already voiced in the request https://github.com/shlinkio/shlink/issues/2449 , the solution was supposedly found in version 4.6, but unfortunately it does not work.

What can be done in this situation?

[acelaya]

You don't need to change anything in your env vars if your redis connection was working with Shlink 4.5

Changes are needed only if you want to use a password-authenticated connection with redis sentinels, which is a new feature introduced in 4.6

Do things work with your old configuration?

[acelaya]

So, I have been trying and I have realized the configuration you provided has auth not only on the redis servers, but in the sentinels as well, which is currently not supported by Shlink (I'm willing to add it, but that would be a new feature request).

@mazminovad can you confirm if you are in fact setting a separate authentication to the sentinels? Or is that a mistake on the reproduction configuration you provided?

I'm asking, because by removing the authentication in the sentinels from your provided config, I can in fact make this work by just updating to the latest version of the redis abstraction, so that would solve your problem.

To summarize, there are two issues with your provided config:

• ACL auth in redis servers does not work due to a bug that can be easily fixed by updating the redis abstraction library (will do this right away).
• ACL auth in sentinels does not work because that has never been implemented. It would require new env vars and verifying the abstraction library has a way to set those (I reckon it does, but still need some investigation).

[acelaya]

Actually, I have realized that, by removing the sentinels authentication, everything works just fine with Shlink 4.6.0 and Shlink 5.0.1 (which was my recollection 🤔)

[mazminovad]

@acelaya This isn't a bug, and this serntinel configuration is supported by the official Bitnami chart.
https://github.com/bitnami/charts/tree/main/bitnami/redis , and yes, we use it.
Since the chart is popular, we might not be the only ones encountering this issue, and it would be great if you could make some improvements :)

[acelaya]

Could you open a feature request to support sentinel auth?

https://github.com/shlinkio/shlink/issues/new?template=Feature_Request.yml

[mazminovad]

@acelaya shlinkio/shlink#2583

[acelaya]

Ok, I have realized this should actually be easy to do. It requires two things:

1. Update to the latest version of the redis abstraction, since it adds support for sentinels ACL.
2. Pass sentinels credentials in the servers URIs via REDIS_SERVERS:

   - REDIS_SERVERS: "tcp://sentinel-0:26379,tcp://sentinel-1:26379,tcp://sentinel-2:26379"
   + REDIS_SERVERS: "tcp://shlink:123456@sentinel-0:26379,tcp://shlink:123456@sentinel-1:26379,tcp://shlink:123456@sentinel-2:26379"
   

Then the connection works.

TL;DR

So basically, when using redis servers which have ACL, together with sentinels which have their own ACL, you need to:

1. Set the list of sentinel URIs including their credentials, via REDIS_SERVERS`.
2. Set the service name via REDIS_SENTINEL_SERVICE
3. Set the redis servers credentials via REDIS_SERVERS_USER and REDIS_SERVERS_PASSWORD so that once Shlink knows the redis master/slave URIs via sentinel request, it also knows the credentials, since sentinels do not disclose that.

[mazminovad]

@acelaya Thanks, we'll be waiting for the release with this improvement 😄