A cache that survives losing the box it runs on.

Redis or Valkey installed bound to the box and passworded from the first minute, then a Sentinel set built by dropping servers into a box: one primary, replicas that copy it, a sentinel beside each. When enough of them agree the primary is gone, they promote a replica themselves and every Sentinel-aware app follows within seconds. Vigia builds it and gets out of the way.

A seven-member Redis Sentinel set in LockFlare Vigia: every member with its role and state, and all 42 wires between them proved from the box each one starts at
Seven members, quorum four, and all 42 wires proved from the box each one starts at.
/ THE INSTALL, AND WHAT IT READS

Installed the way it should have shipped

Redis is fast, and famous for being left open to the internet. So the install is not "apt install redis": it is bound to the box, protected mode on, the password you give set on the default user and kept in an ACL file so it survives a restart, memory limited with an eviction policy chosen, and Vigia's own file included last so it wins over whatever the distribution shipped. The last line of the job says exactly that, and you can copy or download it.

The screen is honest about what it is doing, too: the install runs on the box on its own and closing Vigia does not stop it — but the window stays until it is done, because leaving halfway leaves the box half-changed.

Beside it, what the install leaves on the box, and what the Performance tab reads from it afterwards.

A Sentinel set, built from drop boxes

Drop the servers that should copy this one and press Add. What runs then is one job with the order written on it, because the order is the whole trick: the primary first, listening on its address with the set's password on its default user. Then the firewall — every member lets every other in on 6379 and 26379, all at once. Then each replica, its wire to the primary proved from its own box before it is told to follow, then made to replicate and waited for until the link is up. Then a sentinel beside each member, watching the primary with a quorum Vigia works out from the count.

Nothing restarts. Vigia writes each sentinel's file once and Sentinel owns it from then on. And the same honesty as the install: it runs from this console over the shells, so keep Vigia open until it finishes — closed halfway it stops between boxes, and the same button carries on from where it stopped.

Growing it is the same gesture

Two more boxes? Drop them on the set. Each takes a row and is read at once — its cache, a shell on its saved login — and if one of them has no Redis, Vigia installs it first. Nothing is written until you press Add. Then they are filed as replicas and the set is built again from the top: the firewall opened between every member including the new ones, each new box proved and attached, a sentinel beside each, the quorum recalculated.

And the wires are re-proved. Five members is twenty wires; seven is forty-two — every member to every other on the port, each one tried from the box it starts at, not guessed from a config file. The header says how many are talking and when it was last checked.

The sentinels decide. Vigia writes down what they decided.

This is the part most tools get wrong by pretending they are in charge. They are not: when enough sentinels agree the primary has been gone for five seconds, they promote the replica most in sync, point the others at it, and Sentinel-aware apps follow within seconds. Failover now simply asks them to do it now — and the log names the box they chose, not the box Vigia expected.

Which means the filing on your computer can disagree with reality, and Vigia says so instead of hiding it: this box is filed as the primary but copies another one — the sentinels moved it. Read again files what they say, or Apply puts the filing back on the boxes. Two buttons, two honest choices: accept what happened, or put it back deliberately. The old primary becomes a replica the moment it answers again.

/ CONNECT APPS

Connect apps: the page a developer actually needs

The user, the host, the database number, whether the door speaks TLS — and the connection string built from them, with the password left as a placeholder because it belongs in the app's secrets and not on a screen. Then the same string as working code for the drivers people use: Node with ioredis, Python with redis-py, PHP with Predis, Go with go-redis, and a Laravel .env block. Copy on each.

Two things it tells you that a connection string cannot. That the default user is every command on every key, so an app deserves one of its own — with the door to Access to make it. And that an app on another box needs two things to be true: its address let in on the Firewall tab, and Redis actually listening on that address, not only on loopback.

Beside it, the page for one box, read for an app that lives on another.

# Connect apps · srv-01 · for an app on another box user default # every command on every key host 10.0.0.11 database 0 TLS no # the plain port; TLS is a second port beside it redis://default:<password>@10.0.0.11:6379/0 # the password stays a placeholder: it belongs in the app's secrets as code Node · ioredis Python · redis-py PHP · Predis Go · go-redis Laravel .env Copy on each before the app on 10.0.0.21 can use it ✗ 10.0.0.21 let in on 6379 → the Firewall tab ✗ Redis listening on 10.0.0.11 — only on loopback now → an app deserves a user of its own → Access makes it

What it is doing, and what it is set to

Performance is the numbers that answer a real question: operations per second and the total since start, the hit ratio, memory with its RSS and fragmentation beside it, evictions, clients blocked and rejected, bytes in and out. Under them, the slow commands — when, how long, the command itself and which client sent it — with the sentence that saves an afternoon: the usual names here are the ones that walk everything, and an app user without the dangerous category cannot run them at all. And the open connections, each with what it is doing and a Close beside it.

Settings is the configuration as rows in words. What the address means, what protected mode is a seatbelt against, what the eviction policy actually does to your keys, why a cache wants a limit and a store wants durability. Each row says whether the change is live or waits for a restart, whether Vigia set it or the distribution did, and offers to put it back to the default.

The rest of the tool

KeysPaged with SCAN rather than KEYS, so browsing a million-key cache does not block it. Open a value, read its TTL, delete one, flush a database.
AccessACL users with roles that mean something — full, app, reader — kept in a file under the data directory so they survive a restart. The app that only needs GET and SET gets exactly that.
TLSA second port beside the plain one, with a certificate from the box's own Vigia authority, so an app can verify what it is talking to.
FirewallThe engines' firewall view on the cache's port: who is let in on 6379, read from every member and written per node. The sentinels' 26379 is opened between the members by the set's own build.
Redis or ValkeyBoth, the same screens. The install offers whichever the box's repositories carry; whichever the box runs is what the tool talks to.
Not Redis ClusterSharding is deliberately not built. Sentinel gives a small fleet the failover it actually needs without the operational weight of a cluster.

The same frame runs your databases

MariaDB, PostgreSQL and MongoDB — explorer, users, backups, performance, replication and sharding — on the rail beside this one.

Databases in Vigia