IP Rules by Request Handler

Who may search, who may write

An IP rule lets one address use one part of your index, called a request handler: /select searches, /update writes, /suggest suggests, / is everything. Once a handler has a rule, every address without a rule on it is refused, even with the right password.

For advanced setups. The password alone already protects your index; rules add a second lock. How to add one: IP restriction.

Examples

A new index starts with all on /. It keeps every handler without a rule of its own open to every address, so the examples above limit only the handlers they name. To limit everything, remove all on /.

Use the public address your server goes out with. One rule takes one IPv4 address; add a rule per address.

What a rule can stop

Opensolr's own features reach your index from Opensolr servers, over the internet, like any other client. A rule that leaves those servers out stops them:

• A limit on /select or /: the hosted search page, the Chat Bot, AI answers and the Control Panel tools that read your index stop answering.
• A limit on /update or /: Data Ingestion can no longer write to the index.
• The web crawler is not affected: it writes from the server of the index itself.
• The Solr Admin of the index stops working when its handlers are limited.

Using these features? Keep all on the handlers they use, and let the password protect them.

Good to know

• An index with no rules at all is not reachable from any address.
• When your server changes its address, its requests are refused until you add the new address.
• Rules work on the address the request comes from, so they do not protect a key or a password that leaks: change those too.