Add valkey/redis driver with operator-secret auto-configuration

Apps fronted by valkey-operator instances need the same wait-for-ready
initContainer postgres workloads already get, and wiring per-field
secretKeyRefs for operator-generated secrets is boilerplate. waitfordb
now speaks enough RESP to AUTH and PING, and natively understands the
secret shapes CNPG and valkey-operator generate so an initContainer is
just envFrom plus a mode variable.

- valkey driver (alias: redis): fresh TCP connection per attempt,
  optional AUTH (ACL user or default), PING, reusing the existing
  retry/backoff wait loop; redis:///valkey:// DSNs; default port 6379
- WAITFORDB_SECRET_FORMAT=cnpg|valkey for envFrom-injected operator
  secrets: CNPG <cluster>-app host/port/dbname/user/password keys, and
  valkey-operator key-per-username secrets (_operator preferred, or
  WAITFORDB_USER's same-named key)
- autodetection from injected keys (CNPG keys -> postgres, valkey keys
  -> valkey); explicit WAITFORDB_DRIVER/WAITFORDB_* always win, PG*
  fallback and all existing flags unchanged
- valkey needs no user/database to be valid (unauthenticated PING)
- tests: secret shape parsing/autodetect/mismatch, fake RESP server
  covering NOAUTH/WRONGPASS/ACL auth/DSN, retry-until-up wait
- README: envFrom initContainer snippets for CNPG and valkey-operator

internal/config/config.go

@@ -20,12 +20,24 @@ const (
 var defaultPort = map[string]string{
 	"postgres": "5432",
 	"mysql":    "3306",
+	"valkey":   "6379",
 }
 
+// Secret formats natively understood via WAITFORDB_SECRET_FORMAT (or
+// autodetection): operator-generated secrets injected wholesale with envFrom.
+const (
+	FormatCNPG   = "cnpg"   // CNPG <cluster>-app secret: host/port/dbname/user/password keys
+	FormatValkey = "valkey" // valkey-operator user secrets: key = username, value = password
+)
+
 // Config is the resolved, validated configuration for a single run.
 type Config struct {
 	Driver string
 
+	// SecretFormat records which operator secret convention supplied the
+	// connection parameters ("" when none).
+	SecretFormat string
+
 	// DSN, when set, is a full driver-native connection string that overrides
 	// the discrete Host/Port/User/Password/Database fields.
 	DSN string
@@ -57,26 +69,79 @@ func errf(format string, a ...any) *Error { return &Error{msg: fmt.Sprintf(forma
 type Getenv func(string) string
 
 // Load resolves configuration from env. Connection-parameter precedence is
-// DSN > WAITFORDB_* > PG* (the libpq fallback applies to the postgres driver
-// only).
+// DSN > WAITFORDB_* > PG* > operator-secret keys (the libpq fallback applies
+// to the postgres driver only).
 func Load(get Getenv) (Config, error) {
 	c := Config{
-		Driver:         firstNonEmpty(get("WAITFORDB_DRIVER"), DefaultDriver),
+		Driver:         strings.ToLower(strings.TrimSpace(get("WAITFORDB_DRIVER"))),
 		DSN:            get("WAITFORDB_DSN"),
 		ConnectTimeout: DefaultConnectTimeout,
 		Interval:       DefaultInterval,
 	}
-	c.Driver = strings.ToLower(strings.TrimSpace(c.Driver))
+	if c.Driver == "redis" {
+		c.Driver = "valkey"
+	}
 
-	pg := c.Driver == "postgres"
+	c.Host = get("WAITFORDB_HOST")
+	c.Port = get("WAITFORDB_PORT")
+	c.User = get("WAITFORDB_USER")
+	c.Password = get("WAITFORDB_PASSWORD")
+	c.Database = get("WAITFORDB_DATABASE")
+	c.SSLMode = get("WAITFORDB_SSLMODE")
 
-	// WAITFORDB_* first, then the libpq PG* fallback for postgres.
-	c.Host = pick(get, pg, "WAITFORDB_HOST", "PGHOST")
-	c.Port = pick(get, pg, "WAITFORDB_PORT", "PGPORT")
-	c.User = pick(get, pg, "WAITFORDB_USER", "PGUSER")
-	c.Password = pick(get, pg, "WAITFORDB_PASSWORD", "PGPASSWORD")
-	c.Database = pick(get, pg, "WAITFORDB_DATABASE", "PGDATABASE")
-	c.SSLMode = pick(get, pg, "WAITFORDB_SSLMODE", "PGSSLMODE")
+	format := strings.ToLower(strings.TrimSpace(get("WAITFORDB_SECRET_FORMAT")))
+	formatExplicit := format != ""
+	if formatExplicit {
+		if format != FormatCNPG && format != FormatValkey {
+			return Config{}, errf("unsupported WAITFORDB_SECRET_FORMAT %q (supported: %s, %s)", format, FormatCNPG, FormatValkey)
+		}
+	} else {
+		format = detectFormat(get, c)
+	}
+
+	// An explicit driver wins; otherwise the secret format implies it, falling
+	// back to the historical postgres default.
+	if c.Driver == "" {
+		switch format {
+		case FormatValkey:
+			c.Driver = "valkey"
+		default:
+			c.Driver = DefaultDriver
+		}
+	}
+	if formatExplicit && !formatMatchesDriver(format, c.Driver) {
+		return Config{}, errf("WAITFORDB_SECRET_FORMAT %q does not apply to driver %q", format, c.Driver)
+	}
+	if formatMatchesDriver(format, c.Driver) {
+		c.SecretFormat = format
+	}
+
+	// The libpq PG* fallback for still-unset postgres fields.
+	if c.Driver == "postgres" {
+		fill(&c.Host, get("PGHOST"))
+		fill(&c.Port, get("PGPORT"))
+		fill(&c.User, get("PGUSER"))
+		fill(&c.Password, get("PGPASSWORD"))
+		fill(&c.Database, get("PGDATABASE"))
+		fill(&c.SSLMode, get("PGSSLMODE"))
+	}
+
+	// Operator-secret keys fill whatever is still unset.
+	switch c.SecretFormat {
+	case FormatCNPG:
+		fill(&c.Host, get("host"))
+		fill(&c.Port, get("port"))
+		fill(&c.Database, get("dbname"))
+		fill(&c.User, firstNonEmpty(get("user"), get("username")))
+		fill(&c.Password, get("password"))
+	case FormatValkey:
+		if c.User == "" && get("_operator") != "" {
+			c.User = "_operator"
+		}
+		if c.Password == "" && c.User != "" {
+			c.Password = get(c.User)
+		}
+	}
 
 	if c.Host == "" {
 		c.Host = DefaultHost
@@ -102,9 +167,44 @@ func Load(get Getenv) (Config, error) {
 	return c, nil
 }
 
+// detectFormat recognises operator-generated secrets injected via envFrom.
+// CNPG <cluster>-app secrets carry lowercase host/dbname/user keys; valkey
+// user secrets carry one key per username (system users start with "_").
+func detectFormat(get Getenv, c Config) string {
+	if get("host") != "" && get("dbname") != "" && (get("user") != "" || get("username") != "") {
+		return FormatCNPG
+	}
+	if get("_operator") != "" || get("_replication") != "" {
+		return FormatValkey
+	}
+	// An explicit ACL user whose password key is present, with no SQL database
+	// configured anywhere, is the valkey users-secret shape.
+	if (c.Driver == "" || c.Driver == "valkey") && c.User != "" && c.Password == "" &&
+		c.Database == "" && get("PGDATABASE") == "" && get(c.User) != "" {
+		return FormatValkey
+	}
+	return ""
+}
+
+func formatMatchesDriver(format, driver string) bool {
+	switch format {
+	case FormatCNPG:
+		return driver == "postgres"
+	case FormatValkey:
+		return driver == "valkey"
+	}
+	return false
+}
+
+func fill(dst *string, v string) {
+	if *dst == "" {
+		*dst = v
+	}
+}
+
 func (c Config) validate() error {
 	if _, ok := defaultPort[c.Driver]; !ok {
-		return errf("unsupported WAITFORDB_DRIVER %q (supported: postgres, mysql)", c.Driver)
+		return errf("unsupported WAITFORDB_DRIVER %q (supported: postgres, mysql, valkey/redis)", c.Driver)
 	}
 	if c.Interval <= 0 {
 		return errf("WAITFORDB_INTERVAL must be > 0")
@@ -116,7 +216,8 @@ func (c Config) validate() error {
 		return errf("WAITFORDB_TIMEOUT must be >= 0")
 	}
 	// With a DSN the discrete fields are optional (the DSN carries them).
-	if c.DSN == "" {
+	// Valkey needs neither a database nor a user (unauthenticated PING is valid).
+	if c.DSN == "" && c.Driver != "valkey" {
 		if c.Database == "" {
 			return errf("no database configured: set WAITFORDB_DATABASE (or PGDATABASE for postgres) or WAITFORDB_DSN")
 		}
@@ -132,11 +233,17 @@ func (c Config) validate() error {
 func (c Config) Redacted() string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "driver=%s", c.Driver)
+	if c.SecretFormat != "" {
+		fmt.Fprintf(&b, " secret_format=%s", c.SecretFormat)
+	}
 	if c.DSN != "" {
 		fmt.Fprintf(&b, " dsn=%s", redactDSN(c.DSN))
 	} else {
-		fmt.Fprintf(&b, " addr=%s:%s database=%s user=%s password=%s",
-			c.Host, c.Port, c.Database, c.User, redactSecret(c.Password))
+		fmt.Fprintf(&b, " addr=%s:%s", c.Host, c.Port)
+		if c.Database != "" {
+			fmt.Fprintf(&b, " database=%s", c.Database)
+		}
+		fmt.Fprintf(&b, " user=%s password=%s", c.User, redactSecret(c.Password))
 		if c.SSLMode != "" {
 			fmt.Fprintf(&b, " sslmode=%s", c.SSLMode)
 		}
@@ -202,18 +309,6 @@ func redactKeyword(dsn, key string) string {
 	return dsn[:valStart] + "***" + dsn[valEnd:]
 }
 
-// pick returns the WAITFORDB_* value, falling back to the PG* value only when
-// fallback is true (postgres).
-func pick(get Getenv, fallback bool, primary, secondary string) string {
-	if v := get(primary); v != "" {
-		return v
-	}
-	if fallback {
-		return get(secondary)
-	}
-	return ""
-}
-
 func firstNonEmpty(vals ...string) string {
 	for _, v := range vals {
 		if v != "" {

internal/config/config_test.go

@@ -171,3 +171,159 @@ func TestRedactedDSNMasksPassword(t *testing.T) {
 		})
 	}
 }
+
+func TestCNPGAutodetect(t *testing.T) {
+	// Shape of a CNPG <cluster>-app secret injected wholesale via envFrom.
+	c, err := Load(envFrom(map[string]string{
+		"host":     "mydb-rw.ns.svc",
+		"port":     "5432",
+		"dbname":   "appdb",
+		"user":     "appuser",
+		"username": "appuser",
+		"password": "pw",
+	}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.Driver != "postgres" || c.SecretFormat != FormatCNPG {
+		t.Errorf("driver=%q format=%q, want postgres/cnpg", c.Driver, c.SecretFormat)
+	}
+	if c.Host != "mydb-rw.ns.svc" || c.Database != "appdb" || c.User != "appuser" || c.Password != "pw" {
+		t.Errorf("fields not filled from CNPG keys: %+v", c)
+	}
+}
+
+func TestCNPGExplicitFormat(t *testing.T) {
+	c, err := Load(envFrom(map[string]string{
+		"WAITFORDB_SECRET_FORMAT": "cnpg",
+		"host":                    "h",
+		"dbname":                  "d",
+		"username":                "u",
+		"password":                "pw",
+	}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.SecretFormat != FormatCNPG || c.User != "u" {
+		t.Errorf("format=%q user=%q, want cnpg/u", c.SecretFormat, c.User)
+	}
+}
+
+func TestWaitfordbOverridesCNPGKeys(t *testing.T) {
+	c, err := Load(envFrom(map[string]string{
+		"WAITFORDB_HOST": "explicit-host",
+		"host":           "secret-host",
+		"dbname":         "d",
+		"user":           "u",
+		"password":       "pw",
+	}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.Host != "explicit-host" {
+		t.Errorf("host = %q, want explicit-host (WAITFORDB_* wins over secret keys)", c.Host)
+	}
+	if c.Database != "d" || c.Password != "pw" {
+		t.Errorf("unset fields should still fill from secret: %+v", c)
+	}
+}
+
+func TestValkeySystemSecretAutodetect(t *testing.T) {
+	// Shape of the valkey-operator system-passwords secret: key = username.
+	c, err := Load(envFrom(map[string]string{
+		"WAITFORDB_HOST": "myapp-valkey.ns.svc",
+		"_operator":      "op-pass",
+		"_replication":   "repl-pass",
+	}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.Driver != "valkey" || c.SecretFormat != FormatValkey {
+		t.Errorf("driver=%q format=%q, want valkey/valkey", c.Driver, c.SecretFormat)
+	}
+	if c.User != "_operator" || c.Password != "op-pass" {
+		t.Errorf("user=%q password=%q, want _operator/op-pass", c.User, c.Password)
+	}
+	if c.Port != "6379" {
+		t.Errorf("port = %q, want default 6379", c.Port)
+	}
+}
+
+func TestValkeyACLUserSecret(t *testing.T) {
+	// An explicit ACL username whose password arrives as an env key of the
+	// same name (valkey-operator user secret via envFrom).
+	c, err := Load(envFrom(map[string]string{
+		"WAITFORDB_DRIVER": "valkey",
+		"WAITFORDB_USER":   "appuser",
+		"appuser":          "app-pass",
+	}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.SecretFormat != FormatValkey || c.Password != "app-pass" {
+		t.Errorf("format=%q password=%q, want valkey/app-pass", c.SecretFormat, c.Password)
+	}
+}
+
+func TestValkeyExplicitFlagsNoSecret(t *testing.T) {
+	c, err := Load(envFrom(map[string]string{
+		"WAITFORDB_DRIVER":   "valkey",
+		"WAITFORDB_HOST":     "h",
+		"WAITFORDB_PASSWORD": "pw",
+	}))
+	if err != nil {
+		t.Fatalf("valkey needs no user/database: %v", err)
+	}
+	if c.SecretFormat != "" {
+		t.Errorf("format = %q, want none without operator secret keys", c.SecretFormat)
+	}
+}
+
+func TestRedisDriverAlias(t *testing.T) {
+	c, err := Load(envFrom(map[string]string{"WAITFORDB_DRIVER": "redis"}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.Driver != "valkey" || c.Port != "6379" {
+		t.Errorf("driver=%q port=%q, want valkey/6379", c.Driver, c.Port)
+	}
+}
+
+func TestExplicitDriverIgnoresMismatchedDetect(t *testing.T) {
+	// CNPG-shaped keys with an explicit valkey driver: format must not apply.
+	c, err := Load(envFrom(map[string]string{
+		"WAITFORDB_DRIVER": "valkey",
+		"host":             "secret-host",
+		"dbname":           "d",
+		"user":             "u",
+		"password":         "pw",
+	}))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c.SecretFormat != "" {
+		t.Errorf("format = %q, want none (cnpg does not apply to valkey)", c.SecretFormat)
+	}
+	if c.Host != DefaultHost {
+		t.Errorf("host = %q, want default (secret keys must not fill)", c.Host)
+	}
+}
+
+func TestSecretFormatErrors(t *testing.T) {
+	cases := map[string]map[string]string{
+		"unknown format": {"WAITFORDB_SECRET_FORMAT": "vault"},
+		"format/driver mismatch": {
+			"WAITFORDB_SECRET_FORMAT": "cnpg",
+			"WAITFORDB_DRIVER":        "valkey",
+		},
+	}
+	for name, env := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, err := Load(envFrom(env)); err == nil {
+				t.Fatalf("expected error for %s", name)
+			} else if _, ok := err.(*Error); !ok {
+				t.Fatalf("expected *config.Error, got %T", err)
+			}
+		})
+	}
+}

internal/driver/driver_test.go

@@ -8,7 +8,7 @@ import (
 )
 
 func TestGetRegisteredDrivers(t *testing.T) {
-	for _, name := range []string{"postgres", "mysql"} {
+	for _, name := range []string{"postgres", "mysql", "valkey"} {
 		if _, err := Get(name); err != nil {
 			t.Errorf("Get(%q) failed: %v", name, err)
 		}

internal/driver/valkey.go

@@ -0,0 +1,133 @@
+package driver
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"git.unkin.net/unkin/waitfordb/internal/config"
+)
+
+func init() { register(valkey{}) }
+
+type valkey struct{}
+
+func (valkey) Name() string { return "valkey" }
+
+func (valkey) Open(cfg config.Config) (Pinger, error) {
+	p := &valkeyPinger{
+		addr:     net.JoinHostPort(cfg.Host, cfg.Port),
+		user:     cfg.User,
+		password: cfg.Password,
+	}
+	if cfg.DSN != "" {
+		u, err := url.Parse(cfg.DSN)
+		if err != nil {
+			return nil, fmt.Errorf("invalid valkey DSN: %w", err)
+		}
+		if u.Scheme != "redis" && u.Scheme != "valkey" {
+			return nil, fmt.Errorf("unsupported valkey DSN scheme %q (use redis:// or valkey://)", u.Scheme)
+		}
+		port := u.Port()
+		if port == "" {
+			port = "6379"
+		}
+		p.addr = net.JoinHostPort(u.Hostname(), port)
+		if u.User != nil {
+			p.user = u.User.Username()
+			if pw, ok := u.User.Password(); ok {
+				p.password = pw
+			}
+		}
+	}
+	return p, nil
+}
+
+// valkeyPinger speaks just enough RESP to AUTH and PING. Each Ping uses a
+// fresh connection so a half-open socket from a failed attempt cannot linger.
+type valkeyPinger struct {
+	addr     string
+	user     string
+	password string
+}
+
+func (p *valkeyPinger) Ping(ctx context.Context) error {
+	var d net.Dialer
+	conn, err := d.DialContext(ctx, "tcp", p.addr)
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	if dl, ok := ctx.Deadline(); ok {
+		_ = conn.SetDeadline(dl)
+	}
+
+	r := bufio.NewReader(conn)
+	if p.password != "" {
+		args := []string{"AUTH"}
+		if p.user != "" && p.user != "default" {
+			args = append(args, p.user)
+		}
+		args = append(args, p.password)
+		if _, err := roundTrip(conn, r, args...); err != nil {
+			return fmt.Errorf("AUTH %s: %w", p.user, err)
+		}
+	}
+
+	reply, err := roundTrip(conn, r, "PING")
+	if err != nil {
+		return fmt.Errorf("PING: %w", err)
+	}
+	if reply != "PONG" {
+		return fmt.Errorf("PING: unexpected reply %q", reply)
+	}
+	return nil
+}
+
+func (p *valkeyPinger) Close() error { return nil }
+
+func roundTrip(w io.Writer, r *bufio.Reader, args ...string) (string, error) {
+	var b strings.Builder
+	fmt.Fprintf(&b, "*%d\r\n", len(args))
+	for _, a := range args {
+		fmt.Fprintf(&b, "$%d\r\n%s\r\n", len(a), a)
+	}
+	if _, err := io.WriteString(w, b.String()); err != nil {
+		return "", err
+	}
+	return readReply(r)
+}
+
+func readReply(r *bufio.Reader) (string, error) {
+	line, err := r.ReadString('\n')
+	if err != nil {
+		return "", err
+	}
+	line = strings.TrimRight(line, "\r\n")
+	if line == "" {
+		return "", fmt.Errorf("empty reply")
+	}
+	switch line[0] {
+	case '+':
+		return line[1:], nil
+	case '-':
+		return "", fmt.Errorf("server error: %s", line[1:])
+	case '$':
+		n, err := strconv.Atoi(line[1:])
+		if err != nil || n < 0 {
+			return "", fmt.Errorf("unexpected reply %q", line)
+		}
+		buf := make([]byte, n+2) // payload + trailing CRLF
+		if _, err := io.ReadFull(r, buf); err != nil {
+			return "", err
+		}
+		return string(buf[:n]), nil
+	default:
+		return "", fmt.Errorf("unexpected reply %q", line)
+	}
+}

internal/driver/valkey_test.go

@@ -0,0 +1,234 @@
+package driver
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/waitfordb/internal/config"
+	"git.unkin.net/unkin/waitfordb/internal/wait"
+)
+
+// fakeValkey is a minimal RESP server. With user/password set it rejects
+// PING until a matching AUTH arrives, like a real ACL-enabled server.
+type fakeValkey struct {
+	ln       net.Listener
+	user     string
+	password string
+	// refuseFirst counts connections to close immediately before serving.
+	refuseFirst atomic.Int32
+}
+
+func newFakeValkey(t *testing.T, user, password string) *fakeValkey {
+	t.Helper()
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	f := &fakeValkey{ln: ln, user: user, password: password}
+	t.Cleanup(func() { ln.Close() })
+	go f.serve()
+	return f
+}
+
+func (f *fakeValkey) addr() string { return f.ln.Addr().String() }
+
+func (f *fakeValkey) serve() {
+	for {
+		conn, err := f.ln.Accept()
+		if err != nil {
+			return
+		}
+		if f.refuseFirst.Add(-1) >= 0 {
+			conn.Close()
+			continue
+		}
+		go f.handle(conn)
+	}
+}
+
+func (f *fakeValkey) handle(conn net.Conn) {
+	defer conn.Close()
+	r := bufio.NewReader(conn)
+	authed := f.password == ""
+	for {
+		cmd, err := readCommand(r)
+		if err != nil {
+			return
+		}
+		switch strings.ToUpper(cmd[0]) {
+		case "AUTH":
+			user, pass := "default", cmd[len(cmd)-1]
+			if len(cmd) == 3 {
+				user = cmd[1]
+			}
+			wantUser := f.user
+			if wantUser == "" {
+				wantUser = "default"
+			}
+			if user == wantUser && pass == f.password {
+				authed = true
+				fmt.Fprint(conn, "+OK\r\n")
+			} else {
+				fmt.Fprint(conn, "-WRONGPASS invalid username-password pair or user is disabled.\r\n")
+			}
+		case "PING":
+			if !authed {
+				fmt.Fprint(conn, "-NOAUTH Authentication required.\r\n")
+			} else {
+				fmt.Fprint(conn, "+PONG\r\n")
+			}
+		default:
+			fmt.Fprint(conn, "-ERR unknown command\r\n")
+		}
+	}
+}
+
+func readCommand(r *bufio.Reader) ([]string, error) {
+	head, err := r.ReadString('\n')
+	if err != nil {
+		return nil, err
+	}
+	head = strings.TrimRight(head, "\r\n")
+	if !strings.HasPrefix(head, "*") {
+		return nil, fmt.Errorf("bad command header %q", head)
+	}
+	n, err := strconv.Atoi(head[1:])
+	if err != nil || n < 1 {
+		return nil, fmt.Errorf("bad command header %q", head)
+	}
+	out := make([]string, 0, n)
+	for range n {
+		size, err := r.ReadString('\n')
+		if err != nil {
+			return nil, err
+		}
+		size = strings.TrimRight(size, "\r\n")
+		length, err := strconv.Atoi(strings.TrimPrefix(size, "$"))
+		if err != nil {
+			return nil, fmt.Errorf("bad bulk header %q", size)
+		}
+		buf := make([]byte, length+2)
+		if _, err := io.ReadFull(r, buf); err != nil {
+			return nil, err
+		}
+		out = append(out, string(buf[:length]))
+	}
+	return out, nil
+}
+
+func openValkey(t *testing.T, cfg config.Config) Pinger {
+	t.Helper()
+	drv, err := Get("valkey")
+	if err != nil {
+		t.Fatalf("Get(valkey): %v", err)
+	}
+	p, err := drv.Open(cfg)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	t.Cleanup(func() { p.Close() })
+	return p
+}
+
+func splitAddr(t *testing.T, addr string) (host, port string) {
+	t.Helper()
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		t.Fatalf("split %q: %v", addr, err)
+	}
+	return host, port
+}
+
+func pingCtx(t *testing.T) context.Context {
+	t.Helper()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	t.Cleanup(cancel)
+	return ctx
+}
+
+func TestValkeyPingNoAuth(t *testing.T) {
+	f := newFakeValkey(t, "", "")
+	host, port := splitAddr(t, f.addr())
+	p := openValkey(t, config.Config{Host: host, Port: port})
+	if err := p.Ping(pingCtx(t)); err != nil {
+		t.Fatalf("ping: %v", err)
+	}
+}
+
+func TestValkeyPingDefaultUserAuth(t *testing.T) {
+	f := newFakeValkey(t, "", "sekrit")
+	host, port := splitAddr(t, f.addr())
+
+	p := openValkey(t, config.Config{Host: host, Port: port, Password: "sekrit"})
+	if err := p.Ping(pingCtx(t)); err != nil {
+		t.Fatalf("ping with correct password: %v", err)
+	}
+
+	unauth := openValkey(t, config.Config{Host: host, Port: port})
+	if err := unauth.Ping(pingCtx(t)); err == nil || !strings.Contains(err.Error(), "NOAUTH") {
+		t.Fatalf("ping without password: want NOAUTH error, got %v", err)
+	}
+
+	wrong := openValkey(t, config.Config{Host: host, Port: port, Password: "nope"})
+	if err := wrong.Ping(pingCtx(t)); err == nil || !strings.Contains(err.Error(), "WRONGPASS") {
+		t.Fatalf("ping with wrong password: want WRONGPASS error, got %v", err)
+	}
+}
+
+func TestValkeyPingACLUserAuth(t *testing.T) {
+	f := newFakeValkey(t, "_operator", "op-pass")
+	host, port := splitAddr(t, f.addr())
+
+	p := openValkey(t, config.Config{Host: host, Port: port, User: "_operator", Password: "op-pass"})
+	if err := p.Ping(pingCtx(t)); err != nil {
+		t.Fatalf("ping as _operator: %v", err)
+	}
+
+	wrong := openValkey(t, config.Config{Host: host, Port: port, User: "other", Password: "op-pass"})
+	if err := wrong.Ping(pingCtx(t)); err == nil {
+		t.Fatal("ping as wrong user should fail")
+	}
+}
+
+func TestValkeyDSN(t *testing.T) {
+	f := newFakeValkey(t, "app", "pw")
+	p := openValkey(t, config.Config{DSN: "redis://app:pw@" + f.addr()})
+	if err := p.Ping(pingCtx(t)); err != nil {
+		t.Fatalf("ping via DSN: %v", err)
+	}
+}
+
+func TestValkeyDSNBadScheme(t *testing.T) {
+	drv, _ := Get("valkey")
+	if _, err := drv.Open(config.Config{DSN: "postgres://h:5432/d"}); err == nil {
+		t.Fatal("expected error for non-redis DSN scheme")
+	}
+}
+
+func TestValkeyWaitRetriesUntilUp(t *testing.T) {
+	f := newFakeValkey(t, "", "pw")
+	f.refuseFirst.Store(2)
+	host, port := splitAddr(t, f.addr())
+	p := openValkey(t, config.Config{Host: host, Port: port, Password: "pw"})
+
+	res := wait.Run(context.Background(),
+		wait.Params{Timeout: 10 * time.Second, Interval: 10 * time.Millisecond, ConnectTimeout: time.Second},
+		p.Ping,
+		func(int, error, time.Duration, time.Duration, time.Duration) {},
+		wait.RealClock{})
+
+	if !res.OK {
+		t.Fatalf("expected readiness, got %+v", res)
+	}
+	if res.Attempts < 2 {
+		t.Errorf("expected retries before success, got %d attempts", res.Attempts)
+	}
+}