@@ -38,14 +38,12 @@ ../roles/goatcounter.nix
     ../roles/mailer.nix
     ../roles/push-notifications.nix
     ../roles/readeck.nix
+    ../roles/redis-website.nix
     ../roles/searchix.nix
     ../roles/sso.nix
     ../roles/video-library.nix
     ../roles/git-server.nix
   ];
-  age.secrets = {
-    redis-website.file = ../../secrets/redis-website.age;
-  };
 
   boot.loader.efi.efiSysMountPoint = "/boot/efi";
 
@@ -111,12 +109,10 @@ hosts = lib.mkForce {
       ${net-ip4} = [
         "${hostname}.${domain}"
         hostname
-        "redis"
       ];
       ${net-ip6} = [
         "${hostname}.${domain}"
         hostname
-        "redis"
       ];
     };
     defaultGateway = {
@@ -155,7 +151,6 @@ firewall = {
       allowedTCPPorts = [
         53
         853
-        6379
         9418
       ];
       allowedUDPPorts = [
@@ -276,10 +271,6 @@ security.acme = {
     certs."${oldDomain}" = {
       extraDomainNames = [ "*.${oldDomain}" ];
     };
-    certs."redis.${domain}" = {
-      group = "redis-website";
-      reloadServices = [ "redis-website" ];
-    };
   };
 
   services.caddy = {
@@ -325,26 +316,5 @@ enable = true;
     internalInterfaces = [ "ve-+" ];
     externalInterface = netif;
     enableIPv6 = true;
-  };
-
-  services.redis = {
-    servers = {
-      website = {
-        enable = true;
-        port = 0;
-        bind = null;
-        databases = 1;
-        maxclients = 20;
-        requirePassFile = config.age.secrets.redis-website.path;
-        settings = {
-          notify-keyspace-events = "KEA";
-          tls-port = 6379;
-          tls-cert-file = "/var/lib/acme/redis.${domain}/cert.pem";
-          tls-key-file = "/var/lib/acme/redis.${domain}/key.pem";
-          tls-ca-cert-file = "/etc/ssl/certs/ca-certificates.crt";
-          tls-auth-clients = false;
-        };
-      };
-    };
   };
 }