DCA Hardened Key-Value Store — for Valkey™ — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	Valkey (BSD-3-Clause) — see licenses
Version	Valkey 9.1.2 (official prebuilt Ubuntu 24.04 x86-64 binaries from download.valkey.io, sha256-verified) on Ubuntu 24.04 LTS; Google Cloud image built 2026-10-07. Exact image version: see the listing. Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• Google Cloud Marketplace — listing in preparation — Compute Engine image and deployment package built and verified on booted VMs; not yet public (base: Ubuntu 24.04 LTS)

Network ports

Port	Purpose	State
22	SSH — key-only, OS Login (IAM); the deployment package adds no SSH rule	your VPC's firewall rules
6379	Valkey — bound to 127.0.0.1 and ::1 (bind in /etc/valkey/valkey.conf)	customer-must-open (config + firewall toggle)

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH in with OS Login (gcloud compute ssh INSTANCE_NAME --zone ZONE --tunnel-through-iap), then use valkey-cli with this VM's password in VALKEYCLI_AUTH.

A 32-character password generated on THIS VM's first boot by valkey-firstboot.service: requirepass for the default user in /etc/valkey/auth.conf (root:valkey 0640), with your copy in /root/valkey-credentials.txt (root-only, 0600). No password exists in the image.

sudo sed -n 's/^VALKEY_PASSWORD=//p' /root/valkey-credentials.txt

Rotation: Edit requirepass in /etc/valkey/auth.conf, run sudo systemctl restart valkey, then update /root/valkey-credentials.txt (or your secret store) and every client.

Step-by-step: first login / credentials.

Data & dependencies

• Data locations: /var/lib/valkey (AOF in appendonlydir/, RDB snapshots in dump.rdb) — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: valkey-firstboot.service mints the per-VM password into /etc/valkey/auth.conf and /root/valkey-credentials.txt before valkey.service first starts; valkey-verify-firstboot.service then proves against the running server that the password works, that no password and a wrong one are refused, that it runs 9.1.2 and that 6379 is loopback-only, and writes /var/lib/dca-firstboot/valkey.verified.
• Update / patch: Recommended: deploy the newest image version and copy /var/lib/valkey across with valkey stopped on both VMs. Valkey is not an apt package on this image, so apt and unattended-upgrades never change it (they patch Ubuntu); an in-place upgrade means replacing the binaries in /opt/valkey/bin with a newer verified release.
• Backup / restore: Snapshot the boot disk, or copy the whole /var/lib/valkey (appendonlydir/ and dump.rdb) with valkey stopped; restore both from the same backup, owned by valkey.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: systemd journal: journalctl -u valkey -f
• Health check: VALKEYCLI_AUTH="$(sudo sed -n 's/^VALKEY_PASSWORD=//p' /root/valkey-credentials.txt)" valkey-cli PING → PONG

Known limitations

Single node: no replicas, Sentinel or TLS listener are configured. The deployment package creates one boot disk and no separate data disk.

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy

Valkey™ names the open-source software this image packages. Derek Coleman & Associates Inc is not affiliated with or endorsed by the Valkey project.