CacheDeck

CacheDeck is a native iOS client (version 1.1.5) for Redis-compatible servers — Redis OSS/CE, Valkey, and KeyDB, anything speaking RESP2 or RESP3. Built with Swift 6 and SwiftUI for developers, DevOps, and SREs on call, it connects over TLS or an SSH tunnel, then lets you inspect keys, run commands, and fix production problems in seconds from an iPhone. It is purpose-built for mobile on-call use, not a ported desktop tool or a web UI.

Problem

When a cache goes sideways at 2am, the person on call rarely has a laptop open. Existing options are desktop apps, a web UI behind more infrastructure, or a raw redis-cli over SSH with no guardrails — none of which are safe or comfortable to drive from a phone against a production server. And connecting a mobile app to production means trusting it with real credentials.

Solution

CacheDeck brings a full-featured client to the device while treating trust as the core feature. Production credentials — hosts, passwords, ACL users, keys, and certs — are stored only on-device in the iOS Keychain and never leave it. There is no backend, no proxy, and no traffic relay: the connection goes straight from the phone to the server.

The feature set aims at parity with desktop tooling:

• Connections over direct TCP, TLS (with certificate fingerprint inspection), or an SSH tunnel through a bastion, with a Face ID app lock.
• Key browser that walks the keyspace with SCAN (as a list or a namespace tree) and never resorts to KEYS *.
• Value viewing and editing for Strings, Hashes, Lists, Sets, Sorted Sets, and Streams.
• Workbench — a CLI console where every command is classified before it runs.
• Cluster and Sentinel — live topology health, slot routing, master discovery, and failover.
• Pub/Sub monitor, Streams consumer groups, and Redis Stack reads (RedisJSON, RediSearch, RedisTimeSeries).
• Analyze — memory breakdown, slow log, and INFO diagnostics with actionable tips.

Engineering Highlights

• SSH tunnel through a bastion: implemented on Apple’s swift-nio-ssh with directTCPIP child channels, running over Network.framework (NIOTS) so the tunnel’s path monitoring survives a Wi-Fi to cellular handoff and reconnects with backoff — a real requirement for on-call use on a phone.
• Per-command safety layer: a classifier tokenizes and classifies every command by name and arguments before it is sent, driving type-to-confirm on destructive operations (FLUSHALL, FLUSHDB, CONFIG SET, mass DEL), costly-operation warnings, a per-connection read-only guard, and a production badge — protection a bare redis-cli structurally cannot provide.
• On-device credential model: secrets live in the iOS Keychain; the SSH host-key and TLS trust stores use fingerprint pinning with per-connection accept (trust on first use).
• Privacy by construction: the RESP parser and tunnel carry no payload bytes in errors, and a credential sanitizer keeps passwords, hostnames, key names, and values out of logs and out of scrubbed crash and analytics reports.
• RESP3 protocol: full RESP2 and RESP3 (HELLO 3) support with typed aggregates, written in Swift 6 with strict concurrency.

Outcome

Available on the App Store as a one-time purchase ($14.99 / 17.99 €) — no subscription, no in-app purchases, no ads, and no account required. Anonymous, opt-out diagnostics power crash reporting and usage analytics; everything else stays on the device.

---

Redis is a registered trademark of Redis Ltd. CacheDeck is not affiliated with, endorsed by, or sponsored by Redis Ltd.