4 ms·
Nice. This looks promising. Very clean API. I like the focus on a narrow use case. Do you have any information on security topics like using TLS, client authen
by time0ut 7y ago
Nice. This looks promising. Very clean API. I like the focus on a narrow use case.
Do you have any information on security topics like using TLS, client authentication, etc?
- Kerollmops 7y agoCurrently we think this kind of security can be enabled by a simple nginx setup, allowing autorefesh of certificates easily (e.g. certbot). But in the future we will probably handle that in the engine itself.
- mst 7y agoI was thinking it might be nice to be able to have an HMACed token with an expiry as an option - so e.g. my main http-serving thing could provide one of those to allow the frontend to read for a bit but kick the user off after half an hour or whatever if the token isn't refreshed. I've no issue with offloading SSL to a different process though, I tend to prefer doing that anyway a lot of the time.
- Kerollmops 7y agoI understand what you mean but is it for a specific usage of a search engine? I was thinking that this kind of time-restricted tokens could also be managed by the nginx instance, our engine doesn't support that for the time being.
- mst 7y agoI can make the nginx instance do that. Was just thinking for "simplest possible deployment" it would be nice to be able to have clients hit the meili instance basically directly to take maximum advantage of the speed. Note that I'm not saying "this should be priority 1" or anything, I'm already thinking about how to configure nginx to handle the hmac crap if I try meili out :)