recommended redis maxmemory_policy?

[jjb]

I was surprised to find little discussion of this anywhere and no mention in issues or code, so I wonder if I'm using the wrong search terms - I'm wondering what a recommended redis maxmemory_policy is. I'm guessing noeviction is not a good idea.

claude says

The volatile-lru recommendation is logical since Rack Attack uses expiring keys, but it's not formally documented by the project

deepseek says

If you are unsure or don't use TTLs, start with allkeys-lru.

If you confidently set TTLs on all Rack::Attack keys, use volatile-ttl.

[mperham]

rack-attack uses Redis as a persistent cache and should be setting TTLs on all keys so I would agree with volatile-ttl. Any keys without TTLs should be considered a bug.

[santib]

Agree with Mike, volatile-ttl seems the best option. I guess the only exception would be if you want to hard fail in case the Redis memory gets filled to prevent an attacker doing this on purpose to bypass Rack::Attack.