Meilisearch

Search the Azure Marketplace for Meilisearch on Ubuntu 24.04 and choose your VM size.

Attach a network security group (NSG) that allows TCP 22 (SSH) from your management network. Also allow TCP 80 and 443 (the API) from the networks and applications that need to query it. For production, front port 80 with TLS as described in Step 9.

RG="meilisearch-prod"; LOCATION="eastus"; VM_NAME="meilisearch-01" IMAGE_URN="sac1647283583153:meilisearch-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name meili-vnet --address-prefix 10.90.0.0/16 --subnet-name meili-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name meili-nsg az network nsg rule create -g "$RG" --nsg-name meili-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name meili-nsg --name allow-web --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 443 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:meilisearch-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name meili-vnet --subnet meili-subnet --nsg meili-nsg --public-ip-sku Standard

Connect to the VM as the azureuser administrator:

ssh azureuser@<vm-ip>

Meilisearch listens on loopback 127.0.0.1:7700, and nginx fronts the API on port 80. The health endpoint is public. Every other endpoint requires your master key.

sudo systemctl start meilisearch nginx 2>/dev/null || true
sudo systemctl is-active meilisearch nginx ss -tln | grep -E ':80 |127.0.0.1:7700' curl -s http://127.0.0.1/health

The output shows both services active, the two listening sockets, and {"status":"available"} from the health endpoint.

The first-boot service generated this VM's master key and stored it in a root-only file. Read the file and keep the key secret, because it authenticates every API request. Then confirm that unauthenticated requests are rejected.

sudo cat /root/meilisearch-info.txt echo "unauthenticated /keys -> HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/keys)"

The info note holds MEILI_MASTER_KEY and the instance URL. It is owned by root:root with mode 0600. An unauthenticated call to /keys returns 401, because production mode enforces authentication.

Load the master key into a shell variable, create a movies index, configure its attributes and add a few documents. Then run a typo-tolerant search.

Indexing is asynchronous, so wait for the documents to be processed before you search.

export
MEILI_KEY=$(sudo grep '^MEILI_MASTER_KEY=' /root/meilisearch-info.txt | cut -d= -f2-) H="Authorization: Bearer $MEILI_KEY" curl -s -X PATCH http://127.0.0.1/indexes/movies/settings -H "$H" -H 'Content-Type: application/json' \
  --data '{"filterableAttributes":["genres","release_year"],"sortableAttributes":["release_year"]}' >/dev/null curl -s -X POST 'http://127.0.0.1/indexes/movies/documents?primaryKey=id' -H "$H" -H 'Content-Type: application/json' \
  --data '[ {"id":1,"title":"Interstellar","genres":["Science Fiction","Drama"],"release_year":2014}, {"id":2,"title":"Inception","genres":["Action","Science Fiction"],"release_year":2010}, {"id":3,"title":"The Matrix","genres":["Action","Science Fiction"],"release_year":1999}, {"id":4,"title":"Dune","genres":["Science Fiction","Adventure"],"release_year":2021}, {"id":5,"title":"Arrival","genres":["Science Fiction","Drama"],"release_year":2016} ]' >/dev/null for i in $(seq 1 20); do
N=$(curl -s -H "$H" http://127.0.0.1/indexes/movies/stats | jq -r '.numberOfDocuments // 0') [ "$N" -ge 5 ] && break; sleep 1 done echo "indexed documents: $N" curl -s -X POST http://127.0.0.1/indexes/movies/search -H "$H" -H 'Content-Type: application/json' \
  --data '{"q":"scince fiction","limit":3}' | jq -r '.hits[].title'

The query contains a deliberate typo (scince fiction). Meilisearch still returns the science fiction titles, ranked by relevance, in a fraction of a millisecond.

In Step 6 you marked genres and release_year as filterable and release_year as sortable, so you can now filter and sort results. This query returns science fiction films released after 2013, newest first.

export
MEILI_KEY=$(sudo grep '^MEILI_MASTER_KEY=' /root/meilisearch-info.txt | cut -d= -f2-) H="Authorization: Bearer $MEILI_KEY" curl -s -X POST http://127.0.0.1/indexes/movies/search -H "$H" -H 'Content-Type: application/json' \
  --data '{"q":"","filter":"genres = \"Science Fiction\" AND release_year > 2013","sort":["release_year:desc"],"limit":5,"attributesToRetrieve":["title","release_year"]}' \
  | jq -r '.hits[] | .title + " (" + (.release_year|tostring) + ")"'

Meilisearch combines classic keyword search with vector search, so a query can match on meaning as well as words. Configure an embedder on the index, for example an OpenAI-compatible provider, or supply your own vectors. Then pass a hybrid object on the search request.

The embedder configuration looks like this:

{ "embedders": { "default": { "source": "openAi", "apiKey": "YOUR_PROVIDER_API_KEY", "model": "text-embedding-3-small" } } }

Once an embedder is set, add "hybrid": {"embedder": "default", "semanticRatio": 0.5} to any search body to blend keyword and semantic relevance. See the Meilisearch documentation for embedder options and self-hosted models.

nginx fronts the API on port 80 and is ready for TLS. Point a DNS record at the VM, then obtain a certificate with certbot. Certbot configures nginx for port 443.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

After the certificate is issued, restrict the NSG so only port 443 (and port 22 from your management network) is reachable. Then query the API over https://your-domain.example.com/.