SphereCache (Valkey)

SphereCache is a managed Valkey cache in your environment. It runs Valkey, the open-source in-memory data store from the Linux Foundation. Valkey client libraries and most existing cache clients connect without changes.

Use it for caching, sessions, rate limits and short-lived job data. For data you can't afford to lose, keep the source of truth in a database.

Regions: Sweden and US East.

Sizes and prices

You pay a fixed monthly price for each cache. High availability runs two copies and costs twice the price.

Size	vCPU	Memory	Per month	With high availability
Cache 256 MB	0.1	256 MB	$9	—
Cache 1 GB	0.25	1 GB	$19	—
Cache 3 GB	0.5	3 GB	$57	$114
Cache 5 GB	1	5 GB	$95	$190
Cache 10 GB	2	10 GB	$189	$378
Cache 20 GB	2	20 GB	Coming soon	Coming soon
Cache 40 GB	4	40 GB	Coming soon	Coming soon
Cache 50 GB	4	50 GB	Coming soon	Coming soon
Cache Free	shared	25 MB	Coming soon	—

• Coming soon: Cache 20, 40 and 50 GB, and a free cache. You can't create them yet.

• Regions: prices are for most regions. Southeast Asia, South Africa North and South India cost 25% more. The pricing page has every price.

Create a cache

Console: in a project, choose New, then SphereCache ("In-memory cache"). Pick a name, a size and what happens when memory is full.

Setting	What it does
Name	Lowercase letters, digits and hyphens. Must be unique in the environment.
Size	One of the sizes above.
When memory is full	allkeys-lru (default): the least recently used keys are removed to make room. noeviction: writes are refused until memory is freed.
Version	Valkey 8.1.

Choose the eviction policy when you create the cache

You can't change it on a running cache yet. Pick allkeys-lru for a plain cache. Pick noeviction if you use the cache as a queue, a lock store or anything else where a key must not disappear.

Connect from a service

A cache has a private address that only services in the same environment can reach. There's no public endpoint, and services in other environments can't reach it.

Every connection uses TLS. Copy the connection string from the cache's page in the console, and add it to your service as a secret, for example VALKEY_URL:

rediss://default:<password>@<host>:6379

The scheme is rediss://, with two s's: that's TLS. Clients that take a host and a port need TLS turned on.

The password is hidden until you choose Reveal, which needs write access to the project. Every reveal is recorded in the audit log.

Change the password: choose Rotate password. The old password keeps working until the cache has taken the new one; then reconnect your apps with the new password.

Verify TLS with your environment's CA

Your app checks the connection against your environment's own certificate authority. Every service in the environment has its CA file at /etc/computesphere/db/<key>.crt, where <key> is the cache's host without db-: for the host db-3f9c…, the file is /etc/computesphere/db/3f9c….crt. Point your client's TLS CA setting at that file, and use the host as the TLS server name.

The CA file arrives about 80 seconds after the cache is ready. Most apps read the CA when they start, so restart (redeploy) any service that started before then. The examples below read the file when they connect.

Node.js (iovalkey):

import fs from "node:fs";
import Valkey from "iovalkey";

const url = new URL(process.env.VALKEY_URL);
const ca = fs.readFileSync(`/etc/computesphere/db/${url.hostname.replace(/^db-/, "")}.crt`);

const valkey = new Valkey(process.env.VALKEY_URL, { tls: { ca, servername: url.hostname } });

Python (valkey-py):

import os
from urllib.parse import urlparse
import valkey

url = os.environ["VALKEY_URL"]
host = urlparse(url).hostname
cache = valkey.from_url(url, ssl_ca_certs=f"/etc/computesphere/db/{host.removeprefix('db-')}.crt")

Using redis-py 5.x with asyncio (for example channels-redis)? Pass ssl_cert_reqs as the string "required", not ssl.CERT_REQUIRED.

Go (valkey-go):

import (
	"crypto/tls"
	"crypto/x509"
	"net/url"
	"os"
	"strings"

	"github.com/valkey-io/valkey-go"
)

func connect() (valkey.Client, error) {
	raw := os.Getenv("VALKEY_URL")
	u, err := url.Parse(raw)
	if err != nil {
		return nil, err
	}
	pem, err := os.ReadFile("/etc/computesphere/db/" + strings.TrimPrefix(u.Hostname(), "db-") + ".crt")
	if err != nil {
		return nil, err
	}
	pool := x509.NewCertPool()
	pool.AppendCertsFromPEM(pem)
	opt, err := valkey.ParseURL(raw)
	if err != nil {
		return nil, err
	}
	opt.TLSConfig = &tls.Config{RootCAs: pool, ServerName: u.Hostname()}
	return valkey.NewClient(opt)
}

High availability

A cache with high availability runs a primary and a second copy in another availability zone. If the primary fails, the copy takes over automatically, at the same address. Apps reconnect, and writes during the switch may fail and need a retry.

A failover can lose the last writes the standby hadn't received yet, normally under a second's worth. If the primary is cut off from the rest of the cache (a network partition), writes it accepted while cut off can be lost.

Sizes from Cache 3 GB up offer high availability.

Your data and backups

Paid caches keep their data on disk. A paid cache writes every change to its own disk at least once a second, so a restart or platform maintenance doesn't empty it: it reloads its data and carries on. If it stops suddenly, the last second of writes can be lost.

Without high availability, a cache is unavailable for a few seconds during a restart or platform maintenance, then reloads its data from disk. High availability keeps it available: the standby holds a copy of the data, normally less than a second behind, and takes over if the primary fails.

Cache Free, when it opens, keeps its data in memory only, so a restart or platform maintenance empties it.

Every paid cache is backed up once a day. The last 7 daily copies are kept.

To restore, contact support. Name the cache and the day you want back. Support restores that backup into a new cache, and your original cache keeps running until you switch your apps over. A restore brings back the data as it was at that day's backup. You can't yet list or restore backups yourself from the console.

Limits

• The eviction policy can't be changed on a running cache yet.
• The largest size you can create today is Cache 10 GB.
• A cache's size can't be changed yet: create a new cache and move your apps to it.
• Only Valkey is offered, without modules.