Redis 6 ACLs, and the user per service

Redis had one password and no users, so every service that could read the cache could also flush it — and the credential was the same string in six places.

> ACL SETUSER cache on >s3cr3t 
    ~cache:* 
    +get +set +del +expire +ttl

> ACL SETUSER worker on >an0th3r 
    ~queue:* ~jobs:* 
    +@list +@stream -@dangerous

> ACL GETUSER cache
> ACL WHOAMI

The default user is still there and still has everything, so this changes nothing until it is disabled — ACL SETUSER default off is the step that makes the rest real, and doing it before the services have their own credentials is an outage. The ACL file is separate from redis.conf and is written by ACL SAVE, which nothing does automatically; a restart without it loses every user created at runtime.