Running Solr in read-only mode

I think I'm missing something obvious he开发者_StackOverflow社区re. I have to imagine a lot of people open up their Solr servers to other developers and don't want them to be able to modify the index.

Is there something in solrconfig.xml that can be set to effectively make the index read-only?

Update for clarification: My goal is to use Solr with an existing Lucene index managed by another application. This works just fine, but I want to be sure Solr never tries to write to this index.

---

Exposing a Solr instance to the public internet is a bad idea. Even though you can strip some components to make it read-only, it just wasn't designed with security in mind, it's meant to be used as an internal service, just like you wouldn't expose a RDBMS.

From the Solr Security wiki page:

First and foremost, Solr does not concern itself with security either at the document level or the communication level. It is strongly recommended that the application server containing Solr be firewalled such the only clients with access to Solr are your own. A default/example installation of Solr allows any client with access to it to add, update, and delete documents (and of course search/read too), including access to the Solr configuration and schema files and the administrative user interface.

Even ajax-solr, a Solr client for javascript meant to run in a browser, recommends talking to Solr through a proxy.

Take for example guardian.co.uk: it's well-known that they use Solr for searching, but they built an API to let others access their content. This way they can define and control exactly what and how they want people to search for things.

Otherwise, any script kiddie can write a trivial loop to DoS your Solr instance and therefore bring down your site.

---

You can probably just remove the line that defines your solr.XmlUpdateRequestHandler in solrconfig.xml.

Replication is a nice way to setup read-only while being able to do indexation. Just setup a master with restricted access and a slave that is read-only (by removing your XmlUpdateRequestHandler from the config). The slave will be replicated from the master but won't accept any indexation directly.

UPDATE

I just read that in Solr 1.4, you can disable component. I just tried it on the /update requestHandler and I was not able to index anymore.