From f8abdd18f85172b728d2a6fcfb897824f8258e78 Mon Sep 17 00:00:00 2001
From: Antonia Schwennesen <53372671+zophiana@users.noreply.github.com>
Date: Mon, 23 Feb 2026 13:37:43 +0100
Subject: [PATCH] feat: add REDIS_USER env variable (#172)

* feat: add REDIS_USER env variable

fixes #171

* add proper type for bullmq config
---
 .env.example                         | 2 ++
 docs/user-guides/installation.md     | 1 +
 open-archiver.yml                    | 1 +
 packages/backend/src/config/redis.ts | 7 ++++++-
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 4f2b2c4..8c3997e 100644
--- a/.env.example
+++ b/.env.example
@@ -36,6 +36,8 @@ REDIS_PORT=6379
 REDIS_PASSWORD=defaultredispassword
 # If you run Valkey service from Docker Compose, set the REDIS_TLS_ENABLED variable to false.
 REDIS_TLS_ENABLED=false
+# Redis username. Only required if not using the default user.
+REDIS_USER=notdefaultuser
 
 
 # --- Storage Settings ---
diff --git a/docs/user-guides/installation.md b/docs/user-guides/installation.md
index 1b66c1a..623c857 100644
--- a/docs/user-guides/installation.md
+++ b/docs/user-guides/installation.md
@@ -115,6 +115,7 @@ These variables are used by `docker-compose.yml` to configure the services.
 | `MEILI_INDEXING_BATCH` | The number of emails to batch together for indexing. | `500`                                                    |
 | `REDIS_HOST`           | The host for the Valkey (Redis) service.             | `valkey`                                                 |
 | `REDIS_PORT`           | The port for the Valkey (Redis) service.             | `6379`                                                   |
+| `REDIS_USER`           | Optional Redis username if ACLs are used.            |                                                          |
 | `REDIS_PASSWORD`       | The password for the Valkey (Redis) service.         | `defaultredispassword`                                   |
 | `REDIS_TLS_ENABLED`    | Enable or disable TLS for Redis.                     | `false`                                                  |
 
diff --git a/open-archiver.yml b/open-archiver.yml
index 9fdbb42..9cee935 100644
--- a/open-archiver.yml
+++ b/open-archiver.yml
@@ -22,6 +22,7 @@ services:
             - MEILI_HOST=http://meilisearch:7700
             - REDIS_HOST=valkey
             - REDIS_PORT=6379
+            - REDIS_USER=default
             - REDIS_PASSWORD=${SERVICE_PASSWORD_VALKEY}
             - REDIS_TLS_ENABLED=false
             - STORAGE_TYPE=${STORAGE_TYPE:-local}
diff --git a/packages/backend/src/config/redis.ts b/packages/backend/src/config/redis.ts
index ec21ca8..4d52d2b 100644
--- a/packages/backend/src/config/redis.ts
+++ b/packages/backend/src/config/redis.ts
@@ -1,15 +1,20 @@
 import 'dotenv/config';
+import { type ConnectionOptions } from 'bullmq';
 
 /**
  * @see https://github.com/taskforcesh/bullmq/blob/master/docs/gitbook/guide/connections.md
  */
-const connectionOptions: any = {
+const connectionOptions: ConnectionOptions = {
 	host: process.env.REDIS_HOST || 'localhost',
 	port: (process.env.REDIS_PORT && parseInt(process.env.REDIS_PORT, 10)) || 6379,
 	password: process.env.REDIS_PASSWORD,
 	enableReadyCheck: true,
 };
 
+if (process.env.REDIS_USER !== undefined || process.env.REDIS_USER === '') {
+	connectionOptions.username = process.env.REDIS_USER;
+}
+
 if (process.env.REDIS_TLS_ENABLED === 'true') {
 	connectionOptions.tls = {
 		rejectUnauthorized: false,