Way back redis didnt have passwords at all. That got added but there was no secure transport support.

So I ran redis in a higher memory box at rackspace separate from my db and my app server. I used autossh to forward 6379 from localhost on the app server(s) to the redis server. Worked like a charm and never caused any issues.

Other commenters are right in that wireguard is a great modern solution to this!