Read only public but read write internal?

[Chris Dawson <xr...@gmail.com>]

I want to run a couchdb node which allows public read access so that  
replication can occur but then protect writes behind an application  
server.  Should I set up a firewall or proxy rule that disallows  
anything but GETs on the public IP and then have an application server  
running on the localhost interface which has full HTTP verbs allowed?   
Or is there another topology I should consider?

Thanks
Chris

Chris Dawson
971-533-8335

Re: Read only public but read write internal?

[J Chris Anderson <jc...@gmail.com>]

On Jul 16, 2010, at 4:49 PM, Chris Dawson wrote:

> I want to run a couchdb node which allows public read access so that replication can occur but then protect writes behind an application server.  Should I set up a firewall or proxy rule that disallows anything but GETs on the public IP and then have an application server running on the localhost interface which has full HTTP verbs allowed?  Or is there another topology I should consider?
> 

best is set up a validation function so that writes are only allowed by users with a certain role, then you can give that role to your app server's user. (or maybe even skip the app server altogether and write the rest as a couchapp, but that's another story).

http://books.couchdb.org/relax/design-documents/validation-functions

> Thanks
> Chris
> 
> Chris Dawson
> 971-533-8335

Re: Read only public but read write internal?

[Nils Breunese <N....@vpro.nl>]

Nils Breunese wrote:

> Chris Dawson wrote:
>
>> I want to run a couchdb node which allows public read access so that
>> replication can occur but then protect writes behind an application
>> server.  Should I set up a firewall or proxy rule that disallows
>> anything but GETs on the public IP and then have an application server
>> running on the localhost interface which has full HTTP verbs allowed?
>
> Sure, this works. We only allow GET and HEAD from the big bad internet through our HTTP proxy.

We also disallow access to /_*, so things like /_config and /_stats are not publicly visible to the public.

Nils.

De informatie vervat in deze  e-mail en meegezonden bijlagen is uitsluitend bedoeld voor gebruik door de geadresseerde en kan vertrouwelijke informatie bevatten. Openbaarmaking, vermenigvuldiging, verspreiding en/of verstrekking van deze informatie aan derden is voorbehouden aan geadresseerde. De VPRO staat niet in voor de juiste en volledige overbrenging van de inhoud van een verzonden e-mail, noch voor tijdige ontvangst daarvan.

Re: Read only public but read write internal?

[Nils Breunese <N....@vpro.nl>]

Chris Dawson wrote:

> I want to run a couchdb node which allows public read access so that
> replication can occur but then protect writes behind an application
> server.  Should I set up a firewall or proxy rule that disallows
> anything but GETs on the public IP and then have an application server
> running on the localhost interface which has full HTTP verbs allowed?

Sure, this works. We only allow GET and HEAD from the big bad internet through our HTTP proxy.

Nils

De informatie vervat in deze  e-mail en meegezonden bijlagen is uitsluitend bedoeld voor gebruik door de geadresseerde en kan vertrouwelijke informatie bevatten. Openbaarmaking, vermenigvuldiging, verspreiding en/of verstrekking van deze informatie aan derden is voorbehouden aan geadresseerde. De VPRO staat niet in voor de juiste en volledige overbrenging van de inhoud van een verzonden e-mail, noch voor tijdige ontvangst daarvan.