Ops Runbook — Gateway Redis & Memory Stores

Shared gateway state (JTI replay, rate limits, SSE tickets, Streams, SSE pub/sub) must not silently become per-replica memory in multi-instance deploys.

Boot policy (fail-closed)

Topology	Required env	On Redis connect failure
Production / hardened multi-replica	REDIS_URL set; prefer REQUIRE_REDIS=true	Boot refuses — process exits
Single-replica pilot (memory)	ALLOW_MEMORY_STORE=true, REDIS_URL unset	N/A (memory by design)
Local / test	unset Redis	Soft-falls to memory with stderr warning
REQUIRE_REDIS=true	REDIS_URL required	Boot refuses; ALLOW_MEMORY_STORE cannot override

Do not set both REDIS_URL and ALLOW_MEMORY_STORE expecting soft failover. If REDIS_URL is set and Redis is down, boot refuses (no silent demotion).

Health checks

curl -sS "$GATEWAY_URL/health"
curl -sS "$GATEWAY_URL/healthz"   # alias

Payload fields:

Field	Meaning
status	ok or degraded (postgres down or store down)
postgres	up | down | skipped
store_backend	redis | memory
store	Redis PING → up/down; memory → skipped

Load balancers should treat status=degraded or HTTP ≠ 200 as unhealthy when Redis is mandatory.

Incident: replay possible across replicas

Symptom: Same JWT/jti accepted on more than one gateway instance; rate limits appear ineffective.

Likely cause: Instances booted with memory stores (ALLOW_MEMORY_STORE or Redis never connected).

Actions:

1. GET /health — confirm store_backend is redis and store is up on every replica.
2. Ensure REDIS_URL is identical and reachable from all replicas.
3. Set REQUIRE_REDIS=true and remove ALLOW_MEMORY_STORE for any multi-replica service.
4. Rolling restart after Redis is healthy; spent JTIs in memory are not recovered — treat as a short replay window and rotate partner keys if abuse is suspected.

Provisioning reminders

pnpm --filter @waspada/gateway-api provision

See also Phase B1–B4 runtime env table and RMIT mapping ops row.