IP Rules by Request Handler

Who may search, who may write

An IP rule lets one address use one part of your index, called a request handler: /select searches, /update writes, /suggest suggests, / is everything. Once a handler has a rule, every address without a rule on it is refused, even with the right password.

For advanced setups. The password alone already protects your index; rules add a second lock. How to add one: IP restriction.

Examples

A new index starts with all on /. It keeps every handler without a rule of its own open to every address, so the examples above limit only the handlers they name. To limit everything, remove all on /.

Use the public address your server goes out with. One rule takes one IPv4 address; add a rule per address.

What a rule can stop

Opensolr's own features reach your index from Opensolr servers, over the internet, like any other client. A rule that leaves those servers out stops them:

• A limit on /select or /: the hosted search page, the Chat Bot, AI answers and the Control Panel tools that read your index stop answering.
• A limit on /update or /: Data Ingestion can no longer write to the index.
• The web crawler is not affected: it writes from the server of the index itself.

Using these features? Keep all on the handlers they use, and let the password protect them.

Good to know

• An index with no rules at all is not reachable from any address.
• When your server changes its address, its requests are refused until you add the new address.
• Rules work on the address the request comes from, so they do not protect a key or a password that leaks: change those too.