Installing the Apache Solr cluster

Install and configure the Apache Solr cluster.

1. Connect to the target server using your preferred ssh tool (e.g., PuTTY) and log in.
2. Become the root user:

   sudo su -

3. Download the Solr archive to the /opt directory:

   cd /opt
   wget "https://archive.apache.org/dist/solr/solr/9.5.0/solr-9.5.0.tgz"

4. Extract the Solr installation script from the Solr archive:

   tar xzf solr-9.5.0.tgz solr-9.5.0/bin/install_solr_service.sh --strip-components=2

5. For RHEL:If not yet installed, install the lsof utility program:

   yum install lsof

6. Execute the Solr installation script:

   bash ./install_solr_service.sh solr-9.5.0.tgz

7. Stop the server (since we have to change some OS limits and do some extra configuration):
   For Ubuntu:

   systemctl stop solr

   For RHEL:

   service solr stop

8. Raise the file and process limits for the Solr user:

   nano /etc/security/limits.conf

   Add the following lines at the end of the file:

   solr            soft    nofile          65000
   solr            hard    nofile          65000
   solr            soft    nproc           65000
   solr            hard    nproc           65000

9. Save your changes and exit the editor.
10. Edit the solr.in.sh file:

    nano /etc/default/solr.in.sh

    1. Adjust the available heap space for Solr according to the memory available on your machine, for example: SOLR_HEAP="30g".
    2. Enable SSL by uncommenting the line SOLR_SSL_ENABLED=true.
    3. Adapt the SSL configuration as follows:
       SOLR_SSL_KEY_STORE and SOLR_SSL_TRUST_STORE have to point to a PKCS#12 keystore containing the following certificates:

       • CA certificate chain (for self-signed certificates)
       • Server certificate for this server

       Note: Certificates can no longer be loaded from outside the Solr installation directory. They must now be located in a path that Solr can access, e.g., $SOLR_INSTALLATION_DIR/server/etc/certs.

       Uncomment and set SOLR_SSL_NEED_CLIENT_AUTH to true.

       Uncomment SOLR_SSL_WANT_CLIENT_AUTH.

       Uncomment and set SOLR_SSL_CHECK_PEER_NAME to false.

       Set the Key and Trust Store types to PKCS12.

       # Enables HTTPS. It is implictly true if you set SOLR_SSL_KEY_STORE. Use this config
       # to enable https module with custom jetty configuration.
       SOLR_SSL_ENABLED=true
       # Uncomment to set SSL-related system properties
       # Be sure to update the paths to the correct keystore for your environment
       SOLR_SSL_KEY_STORE=<full path to server keystore>
       SOLR_SSL_KEY_STORE_PASSWORD=<server keystore password>
       SOLR_SSL_TRUST_STORE=<full path to server keystore>
       SOLR_SSL_TRUST_STORE_PASSWORD=<server keystore password>
       # Require clients to authenticate
       SOLR_SSL_NEED_CLIENT_AUTH=true
       # Enable clients to authenticate (but not require)
       SOLR_SSL_WANT_CLIENT_AUTH=false
       # Verify client's hostname during SSL handshake
       SOLR_SSL_CLIENT_HOSTNAME_VERIFICATION=false
       # SSL Certificates contain host/ip "peer name" information that is validated by default. Setting
       # this to false can be useful to disable these checks when re-using a certificate on many hosts
       SOLR_SSL_CHECK_PEER_NAME=false
       # Override Key/Trust Store types if necessary
       SOLR_SSL_KEY_STORE_TYPE=PKCS12
       SOLR_SSL_TRUST_STORE_TYPE=JKS

       SOLR_SSL_CLIENT_KEY_STORE should contain a client certificate (signed with this server's certificate). This is used by a Solr instance to communicate with the other instances.

       Set the Client Key Store type to PKCS12.

       # Uncomment if you want to override previously defined SSL values for HTTP client
       # otherwise keep them commented and the above values will automatically be set for HTTP clients
       SOLR_SSL_CLIENT_KEY_STORE=<full path to client keystore>
       SOLR_SSL_CLIENT_KEY_STORE_PASSWORD=<client keystore password>
       #SOLR_SSL_CLIENT_TRUST_STORE=
       #SOLR_SSL_CLIENT_TRUST_STORE_PASSWORD=
       SOLR_SSL_CLIENT_KEY_STORE_TYPE=PKCS12
       #SOLR_SSL_CLIENT_TRUST_STORE_TYPE=

    4. Further configuration to add at the end of the file:
       • SOLR_HOST = Hostname of this server
       • ZK_HOST = Comma separated list of hosts running Zookeeper along with the connection port (2181 is the default)

       SOLR_PID_DIR="/var/solr"
       SOLR_HOME="/var/solr/data"
       LOG4J_PROPS="/var/solr/log4j2.xml"
       SOLR_LOGS_DIR="/var/solr/logs"
       SOLR_PORT="8983"
       SOLR_HOST="solr01"
       ZK_HOST="solr01:2181,solr02:2181"

       Solr now binds to the localhost network interface by default for better out of the box security. You need to adjust the SOLR_JETTY_HOST property, for example:

       SOLR_JETTY_HOST="0.0.0.0"

       Solr's scripting module needs to be enabled explicitly since the XSLTResponseWriter has been moved to the scripting module instead of shipping as part of Solr core. You need to enable it by adding:

       SOLR_MODULES="scripting"

11. For RHEL:Allow port 8983 in the firewall for external checks:

    firewall-cmd --permanent --add-port=8983/tcp
    firewall-cmd --reload

12. Start the Solr service:
    For Ubuntu:

    systemctl start solr

    For RHEL:

    service solr start