On 10/30/26 15:00, Gus Heck wrote:
...> If you are unable to protect everything but queries with
blockUnknown:false, a rule for all, and * as the required role for queries
then you may have found a bug.
I haven't tried and TBH I am not planning to. If I get a go-ahead to
rebuild our current cluster I'll be very tempted to off-load both SSL
and ACLs to the proxy node and leave the backend "woefully insecure".
(And then our security theater won't complain about "information
disclosure" defaults and "untrusted" self-signed certificates and the
rest of it.)
(I get that Solr has to have it for standalone deployments etc. where
people don't have that option.)
Dima
