Apache ManifoldCF, a content ingestion framework that crawls your repositories into a search index, ready to run a real crawl the moment it boots.
Apache ManifoldCF is an open source framework for moving content out of the systems it lives in and into a search target. Connectors pull documents from filesystems, web sites, SharePoint, RSS feeds, relational databases, email stores and document management systems, and output connectors push them into search engines such as Apache Solr, Elasticsearch and OpenSearch. Between the two sits a crawl scheduler that tracks per document state, so a repeat run only reprocesses what actually changed rather than re indexing everything.
What sets ManifoldCF apart from a plain crawler is its security model. Its authority services translate a user identity into the access tokens that user holds in the source repository, and those tokens are indexed alongside each document, so a search front end can return only the documents a given person is entitled to open. That makes it a common choice in front of SharePoint and filesystem content that carries real access control lists, where showing a user a document title they are not cleared for is itself a disclosure. It suits search and knowledge management teams building enterprise search over content that is spread across many systems and governed by existing permissions.
ManifoldCF ships upstream with a published administrator login of admin and admin, and with its JSON API credential left empty, which means the API answers to anyone who can reach the port. cloudimg closes both before the service is ever reachable, and rotates four separate secrets on the first boot of every instance: the crawler console login, the API credential, the database password and the shutdown token, each unique to that instance and written to a file only root can read. The console and API are the only surfaces published, behind a reverse proxy, while the search engine, the database and the authorization service are held on the loopback interface, because that authorization service has no credential mechanism of its own. The engine is held back from starting until those first boot secrets are actually in place, so an instance can never come up carrying the values baked at build time.
Every image ships with a small sample document set written by cloudimg and a self test that runs a genuine round trip: it defines a repository connection and an output connection, runs a crawl job to completion, and then proves the documents are retrievable from the search index with the content they were given, rather than trusting a job that reports success having ingested nothing. The base is fully patched with unattended security upgrades enabled, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.
Real screenshots taken while testing this image against its deployment guide.