Search — EnclaveStack

Overview

A search service is OpenSearch with a password: it finds words across lots of text quickly and sums up large amounts of data.

When to use it

A search box over products or articles.
Looking through logs or events.
Counts over time.

How it works

OpenSearch 2.19 or 3.3: One single-node container per service, pinned by digest.
Security plugin: On, with an admin password from a managed secret; the REST API uses basic authentication inside the network.
Memory: Half of the memory you give it goes to the engine’s heap.

Each search service runs as one node with its data on a volume and needs no change to the host’s kernel settings. Apps reach it by its private name with the managed password.

Architecture

Apps index and query OpenSearch by name with the managed password.

Flows

Search as you type

The app indexes each product when it changes.
The search box sends the query to OpenSearch.
The best matches come back ranked.

Set it up

In the console

Open Search and choose New search service.
Name it, choose the version and memory.
Choose Create; its page shows the address and the password’s secret.

With the CLI

enclave search create catalog --wait

With OpenTofu

OpenTofu configuration

resource "enclave_search" "catalog" {
  name    = "catalog"
  version = "3"
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_search`
Name	Type	Use	What it does
`name`	text	required	Name of the search service: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the search service.
`machine`	text	optional	The machine to run on (default: EnclaveStack chooses, and this reads back its choice). Changing it moves the resource, with its data, in place; apply waits for the move.
`machine_labels`	map of text	optional	Labels the machine must have, when machine isn't set (key=value, all must match).
`memory_mib`	number	optional	Memory in MiB, 1024–16384 in steps of 256 (default 2048); half is the heap.
`network`	text	optional	Network to place it in (default: the default network). Changes in place.
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`subnet`	text	optional	Subnet of the network (default: its first).
`version`	text	optional	OpenSearch major version, 3 (default) or 2. Changing it replaces the service.
`id`	text	output	Resource ID.
`internal_url`	text	output	REST API inside its network.
`password_secret`	text	output	Name of the managed secret holding the admin password.
`private_dns`	text	output	Name it answers to inside its network: <name>.search.internal.
`url`	text	output	REST API on this machine (none in a network without internet).
`username`	text	output	The admin user.

Limits and security

Good to know

Its version can’t change later.
It keeps the memory you give it whether busy or idle.

Security

Never exposed through a domain or CDN; reachable inside its network with the password.