fix: the ACL fragment comment keeps every line a comment

.github/workflows/tests.yml

@@ -28,6 +28,9 @@ jobs:
     uses: keel-linux/.github/.github/workflows/test-shell.yml@main
     with:
       threshold: 100
+      # tests/redis.bats starts a real redis-server on the rendered ACL
+      # fragment; without it that test would skip and prove nothing here
+      apt-packages: redis-server
   package:
     # Only on a pull request: require-changelog reads the base commit from
     # github.event.pull_request.base.sha, which is empty on a push.

changelog

@@ -1,3 +1,16 @@
+unit-redis-1.0.4 (1) keel; urgency=low
+
+  * lib/redis.sh: a line of the comment redis_acl_fragment writes into
+    /etc/redis/redis.conf.d/50-keel-secret.conf had lost its "#", so the
+    first boot wrote a line Redis reads as a directive and redis-server
+    refused to start ("Unresolved Configuration ... aborting"); found by the
+    headless boot of the Redis 19.0-7 image. tests/redis.bats now checks that
+    every line of the rendered fragment is a comment, a blank or a user rule,
+    and starts a real redis-server on the shipped ACL file and the rendered
+    fragment; the workflow installs redis-server for it.
+
+ -- KeelLinux maintainers <admin@keellinux.org>  Thu, 08 Oct 2026 01:41:14 +0000
+
 unit-redis-1.0.3 (1) keel; urgency=low
 
   * bin/redispass.py draws its password box on the terminal.

overlay/usr/lib/inithooks/lib/redis.sh

@@ -102,7 +102,7 @@ redis_acl_fragment() {
 # The password is not here and is not anywhere on this machine except the
 # file the description points at.
 #
-This file is the only place the account is declared. Redis refuses a
+# This file is the only place the account is declared. Redis refuses a
 # user declared twice across configuration files, so 20-keel-acl.conf names
 # no administrative account at all and this one names it once. Editing this
 # by hand is how an operator would change the account; the password itself

tests/redis.bats

@@ -162,3 +162,42 @@ setup() {
     [ "$(redis_masked s3cret)" = "(6 characters)" ]
     [[ "$(redis_masked s3cret)" != *s3cret* ]]
 }
+
+# --------------------------------------------- the fragment as Redis reads it
+
+@test "every line of the rendered fragment is a comment, blank, or a user rule" {
+    local hash line n=0
+    hash=$(printf '%s' secret | sha256sum | cut -d ' ' -f 1)
+    run redis_acl_fragment admin "$hash"
+    [ "$status" -eq 0 ]
+    while IFS= read -r line; do
+        n=$((n + 1))
+        [[ -z "$line" || "$line" == '#'* || "$line" == 'user '* ]] \
+            || { echo "line $n is neither a comment nor a rule: $line"; false; }
+    done <<< "$output"
+    [ "$n" -gt 1 ]
+}
+
+@test "redis-server starts with the shipped ACL file and the rendered fragment" {
+    command -v redis-server >/dev/null || skip "redis-server is not installed"
+    local hash dir="$BATS_TEST_TMPDIR/redis"
+    mkdir -p "$dir"
+    hash=$(printf '%s' secret | sha256sum | cut -d ' ' -f 1)
+    redis_acl_fragment admin "$hash" > "$dir/50-keel-secret.conf"
+    {
+        echo "port 0"
+        echo "unixsocket $dir/redis.sock"
+        echo "dir $dir"
+        echo "daemonize no"
+        echo "logfile \"\""
+        echo "include $BATS_TEST_DIRNAME/../overlay/etc/redis/redis.conf.d/20-keel-acl.conf"
+        echo "include $dir/50-keel-secret.conf"
+    } > "$dir/redis.conf"
+    # a configuration Redis refuses makes it exit at once; one it accepts
+    # keeps it running until the timeout stops it (status 124)
+    run timeout 3 redis-server "$dir/redis.conf"
+    echo "$output"
+    [ "$status" -eq 124 ]
+    [[ "$output" != *"Unresolved Configuration"* ]]
+    [[ "$output" != *"FATAL CONFIG FILE ERROR"* ]]
+}

version

@@ -1 +1 @@
-1.0.3
+1.0.4