Apache Solr - Hardened Enterprise Search Platform

What is Apache Solr

Apache Solr is an open-source enterprise search platform from the Apache Software Foundation, built on the Apache Lucene library and running as a Java (JVM) service. It provides schema-driven full-text search with hit highlighting, faceting, dynamic clustering, geospatial and range queries, rich-document (PDF, Office) handling, near-real-time indexing, and result ranking over a REST-like HTTP API plus the classic Solr Admin UI. Indexes and configuration sets are persisted on the local filesystem and queried with sub-second latency. This image runs Solr standalone (single node, user-managed) on OpenJDK 21. Apache-2.0 license, no vendor lock-in.

Why self-host Apache Solr

Running Solr on a VM you control keeps every indexed document - which often contains sensitive customer, catalog or operational text - inside your own tenant rather than a managed search service. Self-hosting suits teams with data residency requirements, organisations operating under GDPR, HIPAA or ISO 27001, and any product where the search corpus must stay within your own perimeter with no per-query fees. Solr is Apache-2.0, fully auditable, with no vendor lock-in.

What this VM image adds

Security hardening:

• Unique administrator password generated per instance at first launch - no default credential - stored in /root/solr-credentials.txt (mode 0600)
• Dual-layer Basic Auth - an nginx TLS reverse proxy and Solr's native BasicAuthPlugin both gate the Admin UI and the REST API with the same generated credential, clearing the "authentication disabled" warning
• Solr bound to 127.0.0.1 only - the search server is never exposed directly; nginx terminates TLS on port 443 and proxies to the loopback service on 8983
• Self-signed TLS certificate generated at first launch and replaceable with your own CA-signed certificate (certbot is pre-installed)
• UFW firewall - TCP 443 open externally for buyer use, TCP 22 for SSH; all other inbound dropped; Azure IMDS and WireServer egress pre-configured
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd for system call auditing of critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, kexec disabled, IPv6 off
• /tmp as tmpfs with nosuid, nodev, noexec

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json with Solr pinned by version, PURL, Apache-2.0 license, supplier, and hash
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator credentials file at /root/solr-credentials.txt (mode 0600) with the admin username and password and the Solr Admin UI HTTPS URL

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 recommended)
2. Open NSG: TCP 443 from your trusted sources, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/solr-credentials.txt for the admin password
4. Open https://<PUBLIC_IP>/solr/ in your browser and accept the self-signed certificate warning
5. Log in with the admin username and password from the credentials file - Basic Auth gates both the Admin UI and the REST API

Solr runs standalone (single node) and listens on 127.0.0.1:8983 only; nginx is the TLS and Basic Auth perimeter on port 443 - do not expose 8983 directly. Replace the self-signed certificate with a CA-signed one for production, then run sudo systemctl reload nginx.