redis tls

docs/03_Configuration.md

@@ -17,7 +17,9 @@
         "port": 6379,
         "password": null,
         "database": 0,
-        "key_prefix": "network:"
+        "key_prefix": "network:",
+        "tls": false,
+        "verify_peer": true
     },
     "network": {
         "auth_token": null
@@ -52,6 +54,8 @@
 | `password` | `null` | Redis AUTH password. Prefer the env var (below). |
 | `database` | `0` | Redis logical database (0-15 on stock Redis) |
 | `key_prefix` | `"network:"` | All keys NetworkCore writes start with this prefix. Server registry keys end up at `network:servers:<id>`. Change this only if you're sharing a Redis with something unrelated. |
+| `tls` | `false` | Enables TLS for the Redis connection (Lettuce `rediss://` equivalent). **Set to true whenever Redis is on a different host than the Hytale server**, since the connection crosses untrusted network. |
+| `verify_peer` | `true` | When `tls` is on, verifies the Redis server's certificate against the JVM's default trust store. Set to false only in dev / against self-signed certs. Logs a warning when disabled. |
 
 ### network
 
@@ -92,5 +96,6 @@ These take precedence over the config file at boot time. Use them for secrets so
 - `server.id` left null is fine if you're OK with the id changing on every boot. Set it to something stable like `lobby-prod-01` if you want logs and dashboards to keep continuity across restarts.
 - `server.role` set explicitly per server. This is what dashboards and routing use.
 - `redis.host` pointed at your shared Redis. `redis.password` not in the file; set `REDIS_PASSWORD` env var.
+- `redis.tls` **on** whenever Redis is on a different host than the Hytale server. `verify_peer` stays true unless Redis uses a self-signed cert you haven't loaded into the JVM trust store.
 - `network.auth_token` not in the file; set `NETWORK_AUTH_TOKEN` env var to the same value on every server.
 - `metrics.bind` stays `127.0.0.1`. Run Prometheus on the same host (or use an SSH tunnel / reverse proxy with auth to expose it elsewhere).