Apache Solr 9 on Ubuntu 24.04 on Azure User Guide

Overview

Apache Solr is the leading open-source search platform built on Apache Lucene — full-text search, faceted navigation, rich document indexing, vector kNN retrieval, and the modern Solr Streaming Expressions for analytics over indexed data. The cloudimg image installs Solr 9.10.1 (last 9.x LTS line, Lucene 9 underneath) from the official Apache CDN with SHA-512 verification, alongside OpenJDK 17. The Solr Admin UI and REST API are gated by BasicAuthPlugin with a per-VM cloudimg admin password that's rotated at first boot. A cloudimg core is pre-created from the bundled _default configset so the server is queryable as soon as you log in.

What is included:

• Apache Solr 9.10.1 (Lucene 9) at /opt/solr (symlinked to /opt/solr-9.10.1)
• OpenJDK 17 JRE headless from Ubuntu 24.04 noble main
• Standalone mode (no SolrCloud, no external ZooKeeper) suitable for dev, test, single-tenant production search, and embedded application search
• solr.service running as the unprivileged solr service user
• BasicAuthPlugin + RuleBasedAuthorizationPlugin enabled out of the box
• Pre-created cloudimg core under /var/solr/data/cloudimg
• Per-VM cloudimg password (32 hex chars, double-SHA-256 + salt in security.json) at first boot, plain copy in /stage/scripts/solr-credentials.log
• 24/7 cloudimg support

Prerequisites

Active Azure subscription, SSH key, VNet + subnet. Standard_B2s (4 GB RAM, 1024m heap default) is suitable for dev, test, single-tenant production search, and embedded application search. For larger indexes raise to D4s/D8s and tune SOLR_HEAP in /etc/default/solr.in.sh. NSG inbound: allow 22/tcp from your management CIDR and 8983/tcp from any client CIDR that needs the Solr Admin UI or REST API.

Step 1-3: Deploy + SSH (standard pattern)

ssh azureuser@<vm-ip>

Step 4: Service Status + Version

sudo systemctl is-active solr.service solr-firstboot.service
/opt/solr/bin/solr version

Step 5: Auth Wall + System Info

PASS=$(sudo grep '^SOLR_ADMIN_PASSWORD=' /stage/scripts/solr-credentials.log | cut -d= -f2-)
curl -s -o /dev/null -w 'no-auth: HTTP %{http_code}\n' http://127.0.0.1:8983/solr/admin/info/system
curl -sf -u "cloudimg:${PASS}" 'http://127.0.0.1:8983/solr/admin/info/system?wt=json' | head -c 400

The first call returns 401 (the BasicAuthPlugin auth wall), the second returns the cluster system info JSON including solr-spec-version, JVM, and host details.

Step 6: Read Per-VM Credentials

sudo cat /stage/scripts/solr-credentials.log

Pick up SOLR_ADMIN_URL, SOLR_ADMIN_USER, and SOLR_ADMIN_PASSWORD. The password is a fresh 32-character hex string — no two VMs share credentials.

Step 7: Solr Admin UI — Dashboard

Browse to http://<vm-ip>:8983/solr/ and authenticate as cloudimg. The Dashboard shows the Solr instance, JVM memory, file descriptors, and index size at a glance.

Step 8: Core Selector — cloudimg core

Pick cloudimg in the Core Selector. The core overview lists schema, stats, and the query interface. Click Query to send a *:* query against the empty core; you'll get numFound: 0 until you index documents.

Step 9: Query Interface

The Query tab lets you build queries against the cloudimg core: q=*:*, sorting, faceting, highlighting, and JSON Request API examples are all in the left-hand controls.

Step 10: Index a Document via the JSON Request API

PASS=$(sudo grep '^SOLR_ADMIN_PASSWORD=' /stage/scripts/solr-credentials.log | cut -d= -f2-)
curl -sf -u "cloudimg:${PASS}" -H 'Content-Type: application/json' \
    -d '[{"id":"1","title_t":"hello cloudimg","body_txt":"Solr 9 first document"}]' \
    'http://127.0.0.1:8983/solr/cloudimg/update?commit=true'
curl -sf -u "cloudimg:${PASS}" 'http://127.0.0.1:8983/solr/cloudimg/select?q=*:*&wt=json' | head -c 400

The first call indexes a single document and commits; the second returns the document under response.docs.

Step 11: Create a New Core

sudo -u solr /opt/solr/bin/solr create -c products -d _default

The solr create CLI clones the bundled _default configset and registers a new products core under /var/solr/data/products. The Admin UI Core Selector picks it up immediately.

Step 12: Tune Heap and JVM

Edit /etc/default/solr.in.sh and restart:

sudo systemctl restart solr.service

Defaults on Standard_B2s:

• SOLR_HEAP: 1024m
• SOLR_JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
• SOLR_HOME: /var/solr/data
• SOLR_PORT: 8983

For production raise SOLR_HEAP to 4096m or higher on D4s/D8s instances.

Step 13: Add a Second User

Replace <new-password> with the operator's chosen password:

PASS=$(sudo grep '^SOLR_ADMIN_PASSWORD=' /stage/scripts/solr-credentials.log | cut -d= -f2-)
curl -sf -u "cloudimg:${PASS}" -H 'Content-Type: application/json' \
    -d '{"set-user":{"alice":"<new-password>"}}' \
    'http://127.0.0.1:8983/solr/admin/authentication'
curl -sf -u "cloudimg:${PASS}" -H 'Content-Type: application/json' \
    -d '{"set-user-role":{"alice":["admin"]}}' \
    'http://127.0.0.1:8983/solr/admin/authorization'

Step 14: Backups

Solr's snapshot API takes a point-in-time copy of an index without downtime:

PASS=$(sudo grep '^SOLR_ADMIN_PASSWORD=' /stage/scripts/solr-credentials.log | cut -d= -f2-)
sudo -u solr install -d -m 0755 /var/solr/backups
curl -sf -u "cloudimg:${PASS}" \
    "http://127.0.0.1:8983/solr/cloudimg/replication?command=backup&location=/var/solr/backups&name=demo"

Periodically copy /var/solr/backups to Azure Blob Storage (az storage blob upload-batch) for off-VM retention.

Step 15: Logs and Troubleshooting

sudo journalctl -u solr.service --no-pager -n 80
sudo journalctl -u solr-firstboot.service --no-pager -n 30
sudo tail -50 /var/solr/logs/solr.log 2>/dev/null

Solr writes its main log to /var/solr/logs/solr.log, request log to /var/solr/logs/<date>.request.log, and slow-query log to /var/solr/logs/solr_slow_requests.log. The systemd journal captures stdout from the firstboot script.

Security

• BasicAuthPlugin enforces authentication on every endpoint under /solr/
• /var/solr/data/security.json is 0640 solr:solr and stores double-SHA-256 + salt password digests
• Per-VM credentials at first boot — no shared secrets between deployments
• Restrict NSG inbound on :8983 to the IP ranges that need the Solr Admin UI or REST API
• Enable Solr's own SSL (jetty-ssl.xml + truststore + keystore) for production HTTPS, or terminate TLS at an upstream Application Gateway / Front Door

Support

cloudimg provides 24/7/365 expert technical support. Guaranteed response within 24 hours, one hour average for critical issues. Contact support@cloudimg.co.uk.