felhom.eu/documentation/audits/night-restore-2026-10-17/P6/redis-persistence.md

R-1096 — Redis persistence in the catalog (research, 2026-10-16 night; catalog HEAD af75dc0; nothing changed)

Read-only research (catalog compose files + upstream docs/source). No valkey image in the catalog. No .felhom.yml classifies a Redis volume; every named volume (Redis included) rides the nightly volume dump, taken with the stack stopped, so Redis saves cleanly first.

Facts that hold for all: redis:7-alpine / 7.4-alpine without a config saves RDB snapshots to /data (3600/1, 300/100, 60/10000). An RDB file is written to a temp file and renamed only when complete — a full disk leaves the old file intact (and stop-writes-on-bgsave-error refuses writes until a save succeeds, then recovers by itself). An APPEND-ONLY file damaged in the middle (2026-09-24: zero bytes near the end, „Expected \r\n, got: 0000") makes Redis abort until redis-check-aof --fix; aof-load-truncated yes only covers a cut-off tail.

app	service	persistence today	volume	what the app keeps in Redis	verdict	recommendation	source
romm 5.3.1	romm-redis (redis:7-alpine)	AOF + RDB	romm_redis_data	sessions; RQ job queues; caches reloaded at start; Switch TitleDB / LaunchBox stores (refilled by the next metadata task)	sessions + queue	AOF → RDB (--appendonly no)	docs.romm.app/4.9.2/install/redis-or-valkey/ ; github.com/rommapp/romm 5.3.1 backend/handler/redis_handler.py, backend/startup.py
docmost 0.96.0	docmost-redis	AOF + RDB	docmost_redis_data	BullMQ queues (email, notifications, page history, search index, import/export)	queue	AOF → RDB	github.com/docmost/docmost docker-compose.yml, queue.constants.ts
paperless-ngx 2.20.15	paperless-redis	AOF + RDB	paperless_redis_data	Celery queue (consumption, mail fetch, classifier)	queue	AOF → RDB (upstream's own broker uses the default RDB)	paperless-ngx docs/configuration.md, docker-compose.postgres.yml
immich v3.2.4	immich-redis	AOF + RDB	immich_redis_data	BullMQ job queues + websocket pub/sub; every job can be re-queued from Administration → Jobs	throwaway queue	OFF (--save "" --appendonly no, tmpfs /data) — upstream runs it with no volume	immich docker/docker-compose.yml
nextcloud 34.0.4	nextcloud-redis	AOF + RDB	nextcloud_redis_data	file-locking cache, shared cache, PHP sessions	cache + sessions	OFF (same shape) — upstream examples have no volume	nextcloud/docker README (REDIS_HOST), .examples
outline 1.10.1	outline-redis	RDB (image default)	outline_redis_data	Bull queues, pub/sub, collaboration	queue	keep (RDB is full-disk-safe)	outline server/queues/index.ts, server/storage/redis.ts
dawarich 1.15.3	dawarich-redis (7.4)	RDB only (--save 900 1 --save 300 10 --appendonly no)	dawarich_redis	Sidekiq queue + Rails cache	queue	keep (= upstream)	Freika/dawarich docker/docker-compose.yml

Open before any template edit (why it was NOT edited tonight): the same Redis lines sit in ladder step files (romm 2, docmost 1, nextcloud 2, immich 2) and the step rule for a compose-only change was not checked; removing a volume from compose leaves the old volume on installed boxes (orphan — nightly dump and old-backup restore behaviour unchecked); the AOF → RDB switch keeping existing data is likely (Redis 7 writes dump.rdb at a clean shutdown) but unproven. Also: R-1096's own history is wrong — audits/r672-2026-09-24/B7-redis-aof-fix.txt shows RomM's AOF WAS repaired on 2026-09-24 (cut by 6 631 B, fix_rc=0, romm-redis then running); the 2026-10-16 crash loop has no proven cause (its Redis log was never read).

Update 2026-10-17 (day, burndown 3) — DONE for AOF → RDB; the volume removal deferred

• Proved first on scratch 9202 (audits/burndown-3-2026-10-17/P6/): docmost, 100 probe keys; the RDB line delivered through a catalog (the drill, mirrored into the box) and the dashboard's restart → 100/100 back, aof_enabled:0, rdb_last_bgsave_status:ok (Redis 7 wrote dump.rdb at the AOF instance's shutdown and loaded it); the nightly volume dump + FLUSHALL + the backups page's restore → 100/100 back. Damage: 64 zero bytes in the AOF → „Bad file format … use ./redis-check-aof --fix", exit 1; RDB on a full 1 MiB tmpfs → BGSAVE err, old dump.rdb byte-identical, restart loads it (50 keys); a HALF-CUT dump.rdb also refuses to start („RDB ERROR DETECTED") — the write path never leaves one (temp file + rename).
• Changed: catalog 5d9450b — the five templates --appendonly no; steps/ files unchanged (tested definitions, 09 §6.4 part 5; a frozen app is frozen whole, 09 §3 decision 4 / sync/sync.go renderSource). Gate redis-persistence. A box takes it at the app's next start: demo-hp 9201 restarted through the dashboard 2026-10-17 (romm, docmost, paperless — each aof_enabled:0, healthy).
• Deferred (R-1117): removing the Immich/Nextcloud Redis volume (tmpfs) — it leaves the old volume on installed boxes and the nightly dump / old-backup restore behaviour for a removed volume is unchecked; the RDB switch already removes the danger.
• The old appendonlydir/ stays in each volume (ignored with --appendonly no; ~0.3 MB on docmost). A box whose AOF is ALREADY damaged should now start from its last snapshot, since --appendonly no never reads the AOF (reasoned, NOT measured).