Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of jchris@gmail.com designates
 209.85.212.180 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=content-type:mime-version:subject:from:in-reply-to:date
         :content-transfer-encoding:message-id:references:to:x-mailer;
        b=MVm7WQGdTcQ+8C7ygd3sE6BAXnwLdByYkRYLbaripykqVmfrMAoCR0xFQmzJs42dNV
         ujWgCS6QstX4QJQ8CIpQblcuu3ZFlQ2xLfWMGNM/+hRtXTyctid0/4Y7gcrSYPi1+2uQ
         /dj2H29/aleK0QCwo3DLFeorRroJtlIY2TtKQ=
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1081)
Subject: Re: Read only public but read write internal?
From: J Chris Anderson <jchris@gmail.com>
In-Reply-To: <41895B48-8CD7-4800-A745-D57A18E757F5@gmail.com>
Date: Fri, 16 Jul 2010 17:07:34 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <A65A356C-0230-4A12-A303-0DBCAA6D322C@gmail.com>
References: <41895B48-8CD7-4800-A745-D57A18E757F5@gmail.com>
To: user@couchdb.apache.org


On Jul 16, 2010, at 4:49 PM, Chris Dawson wrote:

> I want to run a couchdb node which allows public read access so that =
replication can occur but then protect writes behind an application =
server.  Should I set up a firewall or proxy rule that disallows =
anything but GETs on the public IP and then have an application server =
running on the localhost interface which has full HTTP verbs allowed?  =
Or is there another topology I should consider?
>=20

best is set up a validation function so that writes are only allowed by =
users with a certain role, then you can give that role to your app =
server's user. (or maybe even skip the app server altogether and write =
the rest as a couchapp, but that's another story).

http://books.couchdb.org/relax/design-documents/validation-functions

> Thanks
> Chris
>=20
> Chris Dawson
> 971-533-8335