From 28fe644776eb3d3ad19865a35501906b2e872056 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Thu, 28 May 2026 17:35:03 +0000
Subject: [PATCH] Support Redis TLS server name

---
 .env.example     |  1 +
 src/lib/redis.ts | 28 +++++++++++++++++++++++-----
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/.env.example b/.env.example
index 44af094..50be670 100644
--- a/.env.example
+++ b/.env.example
@@ -19,6 +19,7 @@ MINTLIFY_DOMAIN=<x>
 
 # Redis Configuration
 REDIS_URL=<x> # redis://127.0.0.1:6379
+# REDIS_TLS_SERVER_NAME=<x> # optional; requires REDIS_URL to use rediss://
 
 # OAuth Client IDs
 KERNEL_CLI_PROD_CLIENT_ID=<x>
diff --git a/src/lib/redis.ts b/src/lib/redis.ts
index d7f740a..3c81182 100644
--- a/src/lib/redis.ts
+++ b/src/lib/redis.ts
@@ -1,16 +1,34 @@
 import { createClient } from "redis";
 import { createHmac } from "crypto";
 
+const redisUrl = process.env.REDIS_URL;
+const redisTlsServerName = process.env.REDIS_TLS_SERVER_NAME;
+const parsedRedisUrl = redisUrl ? new URL(redisUrl) : null;
+
+if (redisTlsServerName && parsedRedisUrl?.protocol !== "rediss:") {
+  throw new Error("REDIS_TLS_SERVER_NAME requires REDIS_URL to use rediss://");
+}
+
+// Modest backoff to smooth over first-hit cold connections
+const reconnectStrategy = (retries: number) =>
+  Math.min(500 + retries * 100, 2000);
+
 // Connect on first use
 let isConnected = false;
 let connectPromise: Promise<void> | null = null;
 
 const client = createClient({
-  url: process.env.REDIS_URL,
-  socket: {
-    // Modest backoff to smooth over first-hit cold connections
-    reconnectStrategy: (retries) => Math.min(500 + retries * 100, 2000),
-  },
+  url: redisUrl,
+  socket: redisTlsServerName
+    ? {
+        host: parsedRedisUrl!.hostname,
+        tls: true,
+        servername: redisTlsServerName,
+        reconnectStrategy,
+      }
+    : {
+        reconnectStrategy,
+      },
 });
 
 client.on("error", (err) => {