Skip to main content
Connect your Redis databases to enable Tony (Database Engineer) to inspect keyspace usage, analyze command patterns, and monitor database health.

Supported platforms

Prerequisites

  • A Redis instance reachable from CloudThinker over the network.
  • Admin access to create an ACL user (self-hosted) or RBAC user (Upstash/Redis Cloud).
  • A REDIS_URL connection string with credentials.

Setup

Select your Redis platform for specific connection instructions.
Two common deployment shapes are supported:
  • Vanilla Redis — minimal image, no modules. Use when you only need core Redis commands.
  • Redis Stack — bundles RediSearch, RedisJSON, RedisTimeSeries, and Bloom. Use when Tony needs FT.*, JSON.*, TS.*, or BF.* commands. Vanilla soft-fails those.
1

Start Redis

Vanilla Redis (no modules):
The admin password is set via the --requirepass server flag. --appendonly yes enables AOF for durability across restarts.Redis Stack (with modules and RedisInsight UI on port 8001):
Verify the instance:
2

Create a read-only ACL user

Create a dedicated user for CloudThinker. Redis ACL usernames allow [A-Za-z0-9_-]; use cloudthinker-readonly.
  • on — enable the user
  • ><readonly-password> — set the password (the > prefix is ACL syntax)
  • ~* — match all keys; narrow to ~app:* for stricter scoping
  • +@read -@write -@dangerous -@admin — reads only; blocks writes, FLUSHALL/CONFIG/DEBUG/SHUTDOWN, and replication
  • Optional: append -@slow to block KEYS, SMEMBERS, HGETALL on large collections
3

Persist ACLs across restart

Mount a users.acl file so ACLs survive container restarts:
Start Redis with the file mounted:
and add --aclfile /data/users.acl to the server command.
4

Verify the read-only user

5

Configure network access

Ensure CloudThinker can reach your database:
  • Add CloudThinker IPs to your firewall or security group
  • Ensure Redis is bound to an accessible interface (avoid bind 127.0.0.1 only)
6

Add the connection in CloudThinker

Navigate to Connections → Redis and enter your connection string as REDIS_URL:
Use rediss:// (note the second s) if your deployment terminates TLS. Click Connect. CloudThinker shows a Connected status once it succeeds.

Connection details

Required permissions

Recommended ACL categories for the CloudThinker user:
Key scoping (~* for all keys, or ~app:* for a prefix) narrows what the CloudThinker user can access. Start with ~* and tighten as needed.

Agent capabilities

Once connected, Tony can:

Verify the connection

Example prompts

Troubleshooting

  • Verify the username and password in the connection URL
  • For self-hosted, confirm the user is enabled with ACL WHOAMI and ACL LIST
  • For Upstash and Redis Cloud, make sure you copied the TCP/Redis CLI URL, not the REST or SDK URL
  • The read-only user is working as intended for write commands
  • If reads are also blocked, re-check the ACL rules — +@read must be granted
  • Verify host and port are reachable from CloudThinker
  • For self-hosted, ensure Redis is not bound only to 127.0.0.1
  • Add CloudThinker IPs to your firewall or cloud provider allowlist
  • Vanilla Redis does not include modules. Run Redis Stack (redis/redis-stack) or a managed equivalent that bundles the required modules.

Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Use rediss:// for TLS — use the rediss:// scheme whenever your deployment supports TLS to encrypt data in transit.
  • Persist ACLs — use aclfile for self-hosted deployments so the read-only user survives restarts.

Tony Agent

Database-focused optimization agent

MongoDB Connection

Setup instructions for MongoDB databases