Install Redis on Debian 13

sudo apt-get update
sudo apt-get install -y redis-server

CONF=/etc/redis/redis.conf

# Listen on loopback only.
sudo sed -i -E '/^[[:space:]]*#?[[:space:]]*bind[[:space:]]/d' "$CONF"
printf 'bind 127.0.0.1 ::1\n' | sudo tee -a "$CONF" >/dev/null

# Reject any command that is not authenticated.
sudo sed -i -E '/^[[:space:]]*#?[[:space:]]*requirepass[[:space:]]/d' "$CONF"
printf 'requirepass change-me-now\n' | sudo tee -a "$CONF" >/dev/null

sudo systemctl restart redis-server
sudo systemctl is-active --quiet redis-server \
  || { echo 'FAIL: redis-server is not running — check: journalctl -u redis-server' >&2; exit 1; }

# 1. Auth must be enforced: an unauthenticated PING has to be refused.
if redis-cli ping 2>/dev/null | grep -qx 'PONG'; then
  echo 'FAIL: Redis answered PING without a password — requirepass is not in effect.' >&2
  exit 1
fi
echo 'PASS: unauthenticated PING was refused.'

# 2. The configured password must work.
if ! redis-cli --no-auth-warning -a change-me-now ping 2>/dev/null | grep -qx 'PONG'; then
  echo 'FAIL: authenticated PING did not return PONG — check requirepass and that the service restarted.' >&2
  exit 1
fi
echo 'PASS: authenticated PING returned PONG.'

PASS: unauthenticated PING was refused.
PASS: authenticated PING returned PONG.

if sudo ss -ltn | grep -q '0.0.0.0:6379'; then
  echo 'FAIL: Redis is listening on a non-loopback address.' >&2
  exit 1
fi
echo 'PASS: Redis is not listening on 0.0.0.0.'