saving uncommitted changes in /etc prior to apt run

.etckeeper

@@ -3970,6 +3970,9 @@ maybe chmod 0755 'rcS.d'
 maybe chown 'redis' 'redis'
 maybe chgrp 'redis' 'redis'
 maybe chmod 2770 'redis'
+maybe chown 'redis' 'redis/redis-bayes.conf'
+maybe chgrp 'redis' 'redis/redis-bayes.conf'
+maybe chmod 0640 'redis/redis-bayes.conf'
 maybe chgrp 'redis' 'redis/redis-server.post-down.d'
 maybe chmod 2755 'redis/redis-server.post-down.d'
 maybe chgrp 'redis' 'redis/redis-server.post-down.d/00_example'

group

@@ -51,7 +51,7 @@ ssh:x:111:
 systemd-coredump:x:999:
 caelebfi:x:1000:
 mysql:x:112:
-redis:x:113:
+redis:x:113:_rspamd
 ssl-cert:x:114:
 ntp:x:115:
 postfix:x:116:

gshadow

@@ -51,7 +51,7 @@ ssh:!::
 systemd-coredump:!!::
 caelebfi:!::
 mysql:!::
-redis:!::
+redis:!::_rspamd
 ssl-cert:!::
 ntp:!::
 postfix:!::

gshadow-

@@ -66,3 +66,5 @@ postgrey:!::
 amavis:!::
 cmk-agent:!::
 unbound:!::
+vmail:x::
+wheel:x::caelebfi

redis/redis-bayes.conf

@@ -0,0 +1,24 @@
+# this is the redis instance used for bayes db,
+# with volatile-ttl eviction policy
+
+# read settings from redis.conf, then override
+include /etc/redis/redis.conf
+
+requirepass 3<kq43j=uB<d7q-e
+
+bind 127.0.0.1
+port 0
+unixsocket /var/run/redis-bayes/redis-server.sock
+unixsocketperm 770
+timeout 0
+pidfile /var/run/redis-bayes/redis-server.pid
+loglevel notice
+logfile /var/log/redis/redis-server-bayes.log
+
+dbfilename bayes.rdb
+
+maxmemory 1GB
+maxmemory-policy volatile-ttl
+
+lazyfree-lazy-eviction yes
+lazyfree-lazy-expire yes

redis/redis.conf

@@ -81,7 +81,7 @@ protected-mode yes
 
 # Accept connections on the specified port, default is 6379 (IANA #815344).
 # If port 0 is specified Redis will not listen on a TCP socket.
-port 6379
+port 0
 
 # TCP listen() backlog.
 #
@@ -99,7 +99,7 @@ tcp-backlog 511
 # on a unix socket when not specified.
 #
 unixsocket /var/run/redis/redis.sock
-# unixsocketperm 700
+unixsocketperm 770
 
 # Close the connection after a client is idle for N seconds (0 to disable)
 timeout 0
@@ -535,7 +535,7 @@ rename-command CONFIG 1142eatmyass
 # limit for maxmemory so that there is some free RAM on the system for slave
 # output buffers (but this is not needed if the policy is 'noeviction').
 #
-maxmemory 1000mb
+#maxmemory 1000mb
 
 # MAXMEMORY POLICY: how Redis will select what to remove when maxmemory
 # is reached. You can select among five behaviors:

rspamd/local.d/classifier-bayes.inc

@@ -1,4 +1,5 @@
 backend = "redis";
-
+servers = "/var/run/redis-bayes/redis-server.sock";
+password = "3<kq43j=uB<d7q-e";
 new_schema = true;
 expire = 1209600O;

rspamd/local.d/redis.conf

@@ -1,3 +1,4 @@
-servers = "127.0.0.1:6379";
+#servers = "127.0.0.1:6379";
+servers = "/var/run/redis/redis.sock";
 password = "3<kq43j=uB<d7q-e";
 compress = true;