Manticore Search

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. Scale up for larger indexes or higher query volume.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp from the clients that query Manticore. For public exposure, front port 80 with TLS (see Step 9, Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Manticore Search by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:manticoresearch-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name manticore \
  --image sac1647283583153:manticoresearch-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name manticore --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Manticore's searchd daemon and nginx are enabled and active on first boot. Confirm the services. Every searchd listener is bound to loopback (127.0.0.1), so the only externally reachable port is nginx on :80.

systemctl is-active manticore.service nginx.service ss -tln | grep -E ':80 |9306|9308|9312' searchd --version | head -1 curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/health

Expected output:

active active LISTEN 0 5 127.0.0.1:9306 0.0.0.0:* LISTEN 0 5 127.0.0.1:9308 0.0.0.0:* LISTEN 0 5 127.0.0.1:9312 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* Manticore 28.4.4 f63d06ecb@26071006 (columnar 13.8.1 ...) (secondary 13.8.1 ...) (knn 13.8.1 ...) health: HTTP 200

Step 5 - Retrieve the per-VM credential

Manticore's SQL and HTTP interfaces have no built-in authentication, so the SecureAnyCloud image never exposes them directly. nginx on :80 fronts the HTTP interface behind HTTP Basic Auth. The password is generated uniquely for this VM on first boot and written to a root-only file. There is no default login to change.

sudo cat /root/manticoresearch-credentials.txt

The file contains three values:

• MANTICORE_USER, which is always manticore
• MANTICORE_PASSWORD, unique to this VM (the <MANTICORE_PASSWORD> referenced throughout this guide)
• MANTICORE_URL, built from this VM's address

Load the password into a shell variable for the commands below:

PASS=$(sudo grep '^MANTICORE_PASSWORD=' /root/manticoresearch-credentials.txt | cut -d= -f2-)

A request without the credential is rejected with HTTP 401. The same request with -u manticore:$PASS returns HTTP 200.

PASS=$(sudo grep '^MANTICORE_PASSWORD=' /root/manticoresearch-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'no credential: HTTP %{http_code}\n' http://127.0.0.1/sql -d 'mode=raw&query=SHOW STATUS'
curl -s -o /dev/null -w 'with credential: HTTP %{http_code}\n' -u "manticore:$PASS" http://127.0.0.1/sql -d 'mode=raw&query=SHOW STATUS'

Expected output:

no credential: HTTP 401 with credential: HTTP 200

Step 6 - Create a real-time table and index documents

Manticore runs in real-time mode, so you create a table and start indexing immediately, with no config edits or restarts. Create a products table over the SQL-over-HTTP endpoint, then index two documents through the JSON /insert endpoint.

PASS=$(sudo grep '^MANTICORE_PASSWORD=' /root/manticoresearch-credentials.txt | cut -d= -f2-)
curl -s -u "manticore:$PASS" http://127.0.0.1/sql \
  -d 'mode=raw&query=CREATE TABLE IF NOT EXISTS products(title text, brand string, price float)' echo
curl -s -u "manticore:$PASS" http://127.0.0.1/insert \
  -d '{"index":"products","id":1,"doc":{"title":"Wireless noise cancelling headphones","brand":"Acme","price":199.0}}' echo
curl -s -u "manticore:$PASS" http://127.0.0.1/insert \
  -d '{"index":"products","id":2,"doc":{"title":"Wired studio headphones","brand":"Acme","price":89.5}}' echo

Each insert returns a JSON acknowledgement:

[{"total":0,"error":"","warning":""}] {"table":"products","id":1,"created":true,"result":"created","status":201} {"table":"products","id":2,"created":true,"result":"created","status":201}

Step 7 - Run a full-text search

Query the products table through the JSON /search endpoint. Manticore returns the matching documents with a relevance _score.

PASS=$(sudo grep '^MANTICORE_PASSWORD=' /root/manticoresearch-credentials.txt | cut -d= -f2-)
curl -s -u "manticore:$PASS" http://127.0.0.1/search \
  -d '{"index":"products","query":{"match":{"title":"headphones"}},"limit":2}' echo

Expected output (abridged):

{"took":0,"timed_out":false,"hits":{"total":2,"total_relation":"eq","hits":[ {"_id":2,"_score":1356,"_source":{"title":"Wired studio headphones","brand":"Acme","price":89.5}}, {"_id":1,"_score":1356,"_source":{"title":"Wireless noise cancelling headphones","brand":"Acme","price":199.0}}]}}

Step 8 - Query over SQL and the MySQL wire protocol

The same data is reachable through SQL over HTTP and, for tools and drivers that speak the MySQL protocol, over the SQL port. Over HTTP, you send SQL to /sql. Over the wire protocol, you connect the standard mysql client to the loopback port 9306. Tunnel that port over SSH from your workstation, as described below.

PASS=$(sudo grep '^MANTICORE_PASSWORD=' /root/manticoresearch-credentials.txt | cut -d= -f2-)
curl -s -u "manticore:$PASS" http://127.0.0.1/sql \
  -d "mode=raw&query=SELECT id, title, price FROM products WHERE MATCH('wireless')" echo mysql -h127.0.0.1 -P9306 -e 'SHOW TABLES; SELECT COUNT(*) AS n FROM products;'

Expected output:

[{"columns":[...],"data":[{"id":1,"title":"Wireless noise cancelling headphones","price":199}],"total":1,"error":"","warning":""}] Table Type products rt n 2

Reaching the SQL wire protocol from your workstation

The SQL port 9306 is bound to loopback and is not exposed through nginx. Tunnel it over SSH, then point any MySQL client at your local end of the tunnel:

ssh -L 9306:127.0.0.1:9306 azureuser@<vm-public-ip>
# in another terminal on your workstation:
mysql -h127.0.0.1 -P9306

Step 9 - Enabling HTTPS

For any public exposure, terminate TLS in front of nginx. Point a DNS record at the VM's public IP, then use certbot to obtain and install a certificate:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d search.example.com

certbot rewrites the nginx site to listen on 443 with your certificate and sets up automatic renewal. Keep the HTTP Basic Auth in place so the credential is still required over TLS. Restrict 80/tcp and 443/tcp in the NSG to the networks that need them.

Step 10 - Maintenance

• Service management: sudo systemctl restart manticore and sudo systemctl restart nginx. Read logs with sudo journalctl -u manticore -e and in /var/log/manticore/.
• Data: real-time tables, the binlog and on-disk data live under data_dir at /var/lib/manticore. Back it up with Manticore's own tooling (manticore-backup) or snapshot the OS disk.
• Configuration: searchd settings live in /etc/manticoresearch/manticore.conf. The listeners are intentionally bound to 127.0.0.1. Keep them loopback-only and reach the engine through the authenticated nginx proxy or an SSH tunnel.
• Credential: rotate the basic auth password by regenerating the htpasswd entry in /etc/nginx/.manticore_htpasswd (sudo htpasswd /etc/nginx/.manticore_htpasswd manticore) and reloading nginx.
• Updates: run sudo apt-get update && sudo apt-get install --only-upgrade manticore, then sudo systemctl restart manticore. OS security updates are applied automatically by unattended-upgrades.

Conclusion

You now have Manticore Search running on Ubuntu 24.04 on Azure. A real-time table is indexed and searchable over the JSON HTTP API, SQL over HTTP and the MySQL wire protocol, all behind a per-VM credential with the engine bound to loopback.

Extend it by indexing your own documents, adding full-text and attribute filters, and fronting it with TLS for production. Every SecureAnyCloud image includes 24/7 support.

Deploy on Azure

Launch Manticore Search on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

Before you deploy this image, you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound port 80 from the networks that query the search API
• The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Connecting to your instance

Connect over SSH on port 22 as the default login user for the operating system variant you launched. This listing currently ships one variant, Ubuntu 24.04 LTS, and its SSH login user is ubuntu.

The search API is served on port 80 through nginx. Manticore itself listens only on 127.0.0.1 ports 9306 (SQL), 9308 (HTTP) and 9312 (binary API).

Where your data lives

Every table, its index files, the document store and the binary transaction log live in /var/lib/manticore, which is a dedicated EBS volume mounted by filesystem identifier. Keeping the index off the operating system disk means you can resize it on its own as the corpus grows.

df -h /var/lib/manticore /

Real output from a running instance:

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 59G 100K 56G 1% /var/lib/manticore /dev/root 38G 3.5G 35G 10% /

To grow the index volume, modify the EBS volume in the EC2 console or with aws ec2 modify-volume. Then extend the filesystem on the instance with sudo resize2fs against the device shown in the Filesystem column above. No downtime is required, and the fstab entry needs no change, because it references the filesystem identifier rather than a device name.

Putting TLS in front of the search API

The image publishes the search API over plain HTTP on port 80, so it works the moment the instance boots with no certificate to obtain first. For production, terminate TLS in front of it. Two common approaches:

• Put the instance behind an Application Load Balancer with an AWS Certificate Manager certificate. Restrict the instance security group so that port 80 accepts traffic only from the load balancer's security group.
• Obtain a certificate for a DNS name you control and terminate TLS on the instance itself in the nginx server block at /etc/nginx/sites-available/sac-manticore. Add a listen 443 ssl; server and redirect port 80 to it.

Validate any nginx change before applying it:

sudo nginx -t

Real output from a running instance:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful

If the configuration test passes, apply it with sudo systemctl reload nginx.

Changing the search API password

The per-instance credential lives in an nginx htpasswd file as a bcrypt hash. To rotate it, generate a new entry and reload nginx. Replace <new-password> with your own value.

sudo htpasswd -B -c /etc/nginx/.manticore.htpasswd admin
sudo chown root:www-data /etc/nginx/.manticore.htpasswd
sudo chmod 0640 /etc/nginx/.manticore.htpasswd
sudo systemctl reload nginx

htpasswd prompts for the new password rather than taking it on the command line, so it is never written to your shell history. Remember to update /root/manticore-credentials.txt afterwards so the note stays accurate.

Maintenance

Check the installed version:

searchd --version

Real output from a running instance:

Manticore 28.4.4 f63d06ecb@26071006 (columnar 13.8.1 dd160f1@26070613) (secondary 13.8.1 dd160f1@26070613) (knn 13.8.1 dd160f1@26070613) (embeddings 1.1.1 dd160f1@26070613)

Check the daemon's own view of its state:

P=$(sudo grep '^MANTICORE_PASSWORD=' /root/manticore-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$P" -d "SHOW STATUS LIKE 'uptime'" http://127.0.0.1/cli

Read the daemon log if a query behaves unexpectedly:

sudo tail -5 /var/log/manticore/searchd.log

The Manticore package is held at the shipped version, so an unattended upgrade cannot move you off it unexpectedly. To upgrade deliberately, release the hold, upgrade and re-apply it:

sudo apt-mark unhold manticore
sudo apt-get update && sudo apt-get install --only-upgrade manticore
sudo apt-mark hold manticore
sudo systemctl restart manticore

Operating system security updates are applied automatically by unattended upgrades.

Manticore ships a backup tool that takes a consistent copy of your tables while the daemon is running:

sudo manticore-backup --backup-dir=/var/backups --all

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat.

• Email: sales@secureanycloud.com
• Live chat: available 24/7 on secureanycloud.com

We help with deployment, schema and index design, relevance tuning, vector and hybrid search setup, bulk loading, replication, backup, TLS termination, storage planning and upgrades.

Deploy on AWS

Launch Manticore Search on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com