Redis: listen on localhost by default

[nh2]

The redis service module listens on all interfaces by default (I found it via simple-nixos-mailserver which inherits nixpkgs' default):

nixpkgs/nixos/modules/services/databases/redis.nix

Lines 88 to 93 in 10acf9a

	bind = mkOption {
	type = with types; nullOr str;
	default = null; # All interfaces
	description = "The IP interface to bind to.";
	example = "127.0.0.1";
	};

I think that is bad, because that is an insecure configuration. Because many people get owned by that, Redis has a protection against it; without further configuration, connecting to the listening port via TCP, it outputs:

-DENIED Redis is running in protected mode because protected mode is enabled, no bind address was specified, no authentication password is requested to clients. In this mode connections are only accepted from the loopback interface. If you want to connect from external computers to Redis you may adopt one of the following solutions: 1) Just disable protected mode sending the command 'CONFIG SET protected-mode no' from the loopback interface by connecting to Redis from the same host the server is running, however MAKE SURE Redis is not publicly accessible from internet if you do so. Use CONFIG REWRITE to make this change permanent. 2) Alternatively you can just disable the protected mode by editing the Redis configuration file, and setting the protected mode option to 'no', and then restarting the server. 3) If you started the server manually just for testing, restart it with the '--protected-mode no' option. 4) Setup a bind address or an authentication password. NOTE: You only need to do one of the above things in order for the server to start accepting connections from the outside.

But it's still listening on the port.

This has been that way for 7 yeas since the module was added in 6b4d76c by @zefhemel.

I think many NixOS modules that define services which are usually used unauthenticated by now make them only listen to 127.0.0.1 by default.

So I think we should do that with the redis module as well.

---

CC recent service module committers @Mic92 @JJJollyjim @flokli @peti @bjornfor @polynomial @offlinehacker

CC simple-nixos-mailserver contributors @r-raymond @phdoerfler @nlewo @eqyiel

[nh2]

Evindence that pretty much all other DB servers listen to 127.0.0.1 by default in NixOS:

memcached

nixpkgs/nixos/modules/services/databases/memcached.nix

Lines 28 to 31 in 7badbf1

	listen = mkOption {
	default = "127.0.0.1";
	description = "The IP address to bind to";
	};

postgresql

nixpkgs/nixos/modules/services/databases/postgresql.nix

Lines 184 to 192 in 7badbf1

	enableTCPIP = mkOption {
	type = types.bool;
	default = false;
	description = ''
	Whether PostgreSQL should listen on all network interfaces.
	If disabled, the database can only be accessed via its Unix
	domain socket or via TCP connections to localhost.
	'';
	};

neo4j

nixpkgs/nixos/modules/services/databases/neo4j.nix

Lines 154 to 156 in 7badbf1

	defaultListenAddress = mkOption {
	type = types.str;
	default = "127.0.0.1";

couchdb

nixpkgs/nixos/modules/services/databases/couchdb.nix

Lines 108 to 110 in 7badbf1

	bindAddress = mkOption {
	type = types.str;
	default = "127.0.0.1";

mongodb

nixpkgs/nixos/modules/services/databases/mongodb.nix

Lines 48 to 51 in 7badbf1

	bind_ip = mkOption {
	default = "127.0.0.1";
	description = "IP to bind to";
	};

influxdb

nixpkgs/nixos/modules/services/databases/influxdb.nix

Line 10 in 7badbf1

bind-address = ":8088";

nixpkgs/nixos/modules/services/databases/influxdb.nix

Line 176 in 7badbf1

bindAddr = (ba: if hasPrefix ":" ba then "127.0.0.1${ba}" else "${ba}")(toString configOptions.http.bind-address);

cassandra

nixpkgs/nixos/modules/services/databases/influxdb.nix

Line 176 in 7badbf1

bindAddr = (ba: if hasPrefix ":" ba then "127.0.0.1${ba}" else "${ba}")(toString configOptions.http.bind-address);

cockroachdb

nixpkgs/nixos/modules/services/databases/cockroachdb.nix

Lines 36 to 41 in 7badbf1

	addressOption = descr: defaultPort: {
	address = mkOption {
	type = types.str;
	default = "localhost";
	description = "Address to bind to for ${descr}";
	};

[nh2]

Fix in PR #100195.