Multi-Tenant SaaS Search Security: Signed Tenant Tokens, Scoped Keys & Caddy HTTP/3
MeiliSizer Blueprint Summary: Never create 10,000 separate indices for 10,000 SaaS customers — file descriptors and RAM metadata explode. Consolidate tenants into one shared index guarded by HMAC-signed Tenant Tokens and Caddy HTTP/3.
Why Multi-Index-Per-Customer Fails Past 500 Tenants (MeiliSizer Guide)
Each standalone LMDB environment or RocksDB shard carries baseline descriptor, mmap table, and thread-scheduler overhead. Storing 5M records across 10,000 B2B organizations inside one unified index with a filterable tenant_id integer field reduces RAM overhead by 65%. Your backend signs a short-lived JWT/HMAC Tenant Token embedding {"filter": "tenant_id = 4821"} so browsers query the search node directly with cryptographic row-level isolation.
Caddyfile HTTP/3 Edge Proxy + CORS + IP Burst Rate-Limiting
# /etc/caddy/Caddyfile — Sub-10ms HTTP/3 Termination in Front of Meilisearch/Typesense
search.your-saas.io {
encode zstd gzip
header {
Access-Control-Allow-Origin "https://app.your-saas.io"
Access-Control-Allow-Methods "GET, POST, OPTIONS"
Access-Control-Allow-Headers "Content-Type, Authorization, X-Meilisearch-Client, X-TYPESENSE-API-KEY"
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
}
reverse_proxy 127.0.0.1:7700 {
transport http {
keepalive 90s
keepalive_idle_conns 256
}
}
}MeiliSizer RAM & NVMe Tier Matrix for MULTI-TENANT-SECURITY
| Catalog Scale | Hot Working Set | Safe Peak RAM | Matched Spec Tier |
|---|---|---|---|
| 500 Orgs / 1M Shared Docs | 2.3 GB Shared Index | 8 GB–16 GB KVM | Hostinger KVM 4 ($10.49/mo) |
| 5,000 Orgs / 5M Shared Docs | 12.8 GB Shared Index | 3.5GHz+ Low-Jitter Edge | Vultr High Frequency 16GB–32GB |
| 25,000+ Orgs / Compliance Isolation | 28.0 GB Shared + Dedicated VIP | 64 GB Dedicated VDS | UltaHost VDS 64GB ($95/mo) |
MeiliSizer Production Checklist: MULTI-TENANT-SECURITY
- Store tenant_id as an indexed integer (int32/int64) in filterableAttributes for sub-millisecond Roaring Bitmap tenant pre-filtering.
- Generate Tenant Tokens on user login with a 2-hour exp claim — zero network call to Meilisearch/Typesense is needed to sign tokens!
- Terminate TLS 1.3 + HTTP/3 QUIC via Caddy with persistent localhost keepalive pools to eliminate TCP handshake overhead.
- Isolate only enterprise "whale" tenants (> 2M private rows) onto dedicated indices while keeping standard tenants pooled.
Vultr High Frequency 3.5GHz+ NVMe Cloud (SG / Tokyo / US / EU) — MeiliSizer Pick
3.5GHz+ Turbo Clock Speeds • Fastest Roaring Bitmap & Prefix FST Intersections in 32 Global Regions
Hostinger KVM DDR5 NVMe VPS (1-Click Docker / Meilisearch) — MeiliSizer Option
Up to 67% OFF + Extra 20% Partner Discount • 8GB–32GB DDR5 RAM + PCIe Gen4 NVMe for LMDB Mmap
MeiliSizer Engineering FAQ: MULTI-TENANT-SECURITY
- Can a user tamper with a Meilisearch Tenant Token or Typesense Scoped Key to read another company’s data?
-
No. Both Meilisearch JWT Tenant Tokens and Typesense HMAC-SHA256 Scoped Search Keys cryptographically sign the mandatory tenant_id filter using your secret Search API Key; altering any character invalidates the signature.
- Does generating a Tenant Token add latency to page loads?
-
Zero external latency — token signing is a pure local HMAC/JWT CPU operation (< 0.05ms) inside your Node.js, Laravel, Python, or Go backend.