#Redis and Caching Configuration

OSA Proxy supports Redis caching for Judge verdicts to speed up repeated requests and reduce CodeScoring load. The cache is disabled by default.

cache:
  judge:
    enabled: true
    redis-db: 1
    ttl: 24h
    refresh-after: 30m
    proactive-refresh-enabled: false
    proactive-refresh-interval: 2h
    proactive-refresh-workers: 10
    key-prefix: "cs:judge:"
  redis:
    address: redis:6379
    username: ""
    password: ""
    db: 0
    tls:
      enabled: false
      ca-file: ""
      server-name: ""

#Parameters

#Redis TLS

To enable TLS, configure:

cache:
  redis:
    address: redis.example.com:6380
    tls:
      enabled: true
      ca-file: ""
      server-name: ""

OSA Proxy uses TLS 1.2 or newer and always verifies the server certificate. Certificate verification cannot be disabled.

When ca-file is empty, the container system trust store is used. When a PEM file is specified, its certificates are added to the system roots rather than replacing them. Leave server-name empty in most deployments so that each connection is verified against the hostname in its address. A non-empty value sets one shared SNI and verification identity for Redis, every Sentinel endpoint, and the discovered master; use it only when that name is present in the SAN of every relevant certificate.

The standard osa-proxy.yml maps these settings to environment variables:

REDIS_TLS_ENABLED=true
REDIS_TLS_CA_FILE=
REDIS_TLS_SERVER_NAME=

#Corporate CA with Docker Compose

For a directory containing corporate CAs, add it to SSL_CERT_DIR while retaining the system directory /etc/ssl/certs:

services:
  osa-proxy:
    environment:
      SSL_CERT_DIR: /etc/ssl/certs:/etc/osa-proxy/certs
      REDIS_TLS_ENABLED: "true"
      REDIS_TLS_CA_FILE: ""
      REDIS_TLS_SERVER_NAME: ""
    volumes:
      - ./certs:/etc/osa-proxy/certs:ro

With an empty REDIS_TLS_CA_FILE, Redis uses the system trust store together with certificates from SSL_CERT_DIR. Alternatively, mount a dedicated PEM bundle and set its container path in REDIS_TLS_CA_FILE.

#Corporate CA with Helm

Create a Secret containing the PEM certificates:

kubectl create secret generic osa-proxy-ca \
  --from-file=corp-root-ca.pem

Enable Redis TLS and mount the Secret through the chart CA directory:

config:
  content: |
    cache:
      judge:
        enabled: true
      redis:
        address: redis.example.com:6380
        tls:
          enabled: true
          ca-file: ""
          server-name: ""

certificates:
  caDirectory:
    enabled: true
    secretName: osa-proxy-ca

The chart adds the mounted directory to the system SSL_CERT_DIR, so ca-file can remain empty. Restart the OSA Proxy pods after updating the Secret so that the client reloads the CAs.

#Redis Sentinel

Enable Sentinel for Redis HA. A regular cache.redis.address is not required in this mode. Redis master and Sentinel credentials are configured independently:

cache:
  judge:
    enabled: true
    ttl: 24h
    refresh-after: 30m
    key-prefix: "cs:judge:"
  redis:
    username: redis-user
    password: redis-password
    db: 0
    tls:
      enabled: true
      ca-file: ""
      server-name: ""
    sentinel:
      enabled: true
      master-name: mymaster
      addresses:
        - sentinel-1:26379
        - sentinel-2:26379
        - sentinel-3:26379
      username: sentinel-user
      password: sentinel-password

In Sentinel mode, one TLS configuration is used for both Sentinel and the discovered Redis master. Therefore, with tls.enabled: true, both services must accept TLS and use certificates trusted by OSA Proxy.

If Redis is temporarily unavailable, OSA Proxy continues to use the available local caching mechanisms.

#Cache Management

Purging verdict cache entries is performed through the Admin API on its dedicated listener (default :8081). Admin API requests require a Bearer token in the Authorization header.

Interactive Swagger UI documentation is available at:

http://127.0.0.1:8081/swagger/

Main cache purge endpoints:

• DELETE /api/v1/cache/purls — delete entries by specific PURLs (the request body contains a JSON array of purls);
• DELETE /api/v1/cache/packages/{packageType} — delete entries by package type with optional filtering by package name (packageName) and repository context (repositoryName and repositoryManagerUrl).

For complete parameter descriptions, authentication details, and curl examples, see Admin API.