Getting started¶
Launch Typesense search server in your AWS account, connect privately and verify the result of your first task.
1. Launch and wait for startup¶
Use the Software Sushi Marketplace version described on this page, Ubuntu 24.04 x86_64, and at least t3.medium / 4 GiB RAM with 24 GiB encrypted gp3 root storage. Keep IMDSv2 enabled. These are minimum starting sizes, not throughput benchmarks. Inbound application ports must remain closed.
For Session Manager, attach a customer-owned instance role with the required Systems Manager permissions and provide outbound HTTPS/DNS connectivity to the relevant endpoints. Your workstation needs AWS CLI, the Session Manager Plugin and permission to start sessions. SSH is an alternative when TCP 22 is restricted to your administrative CIDR. The application itself does not need a model-provider key.
Connect to your instance, then run the following. The second command starts a login shell as ubuntu; run the remaining commands inside that shell.
sudo cloud-init status --wait
sudo -iu ubuntu
umask 077
sudo systemctl is-active typesense.service sushi-typesense-api.service
bash /opt/sushi/docs/demo.sh
Wait for cloud-init to finish and every listed service to report active. The demo checks the installed service; it does not validate your own data or workload. A failed service needs diagnosis before you submit work. Do not recreate the instance identity or run a second server to bypass a startup failure.
2. Use the private connection¶
First boot creates a unique TLS identity and ~/.config/sushi/typesense/access.json for the ubuntu account, with mode 0600. The matching server.crt sits beside it. The installed sushi-typesense-api helper reads these files and verifies TLS without printing credentials. Run it on the instance as ubuntu.
To reach port 8443 from your own workstation, open a separate terminal and replace the placeholders below with your customer profile, Region and instance ID:
aws --profile <customer-profile> --region <region> ssm start-session \
--target <instance-id> \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["8443"],"localPortNumber":["8443"]}'
Keep that terminal open. Forwarding a port does not install the API helper on your workstation or copy its identity files. For a workstation client, transfer only the required certificate and private client file through an authenticated channel, retain private permissions and configure the client to read credentials from that file. Do not put credentials in URLs, command arguments, user data or support logs. Do not disable certificate verification.
3. Create a catalog and search it¶
This creates one uniquely named collection and one invented product, then searches with a misspelling and price filter. Keep the same collection for a readback after reboot; do not re-import it to test persistence.
Run in a new private working directory as ubuntu. The commands write requests and responses there; retain or securely remove them according to your data policy.
COLLECTION="customer_catalog_$(python3 -c 'import uuid; print(uuid.uuid4().hex)')"
export COLLECTION
python3 - <<'PYSEARCH'
import json, os
from pathlib import Path
Path('collection.json').write_text(json.dumps({'name': os.environ['COLLECTION'],
'fields': [{'name': 'name', 'type': 'string'}, {'name': 'price', 'type': 'int32'}]}))
Path('product.json').write_text(json.dumps({
'id': 'coffee-1', 'name': 'Coffee beans', 'price': 12}))
PYSEARCH
sushi-typesense-api POST /collections --input collection.json > collection-created.json
sushi-typesense-api POST "/collections/$COLLECTION/documents" --input product.json > product-created.json
sushi-typesense-api GET "/collections/$COLLECTION/documents/search?q=cofee&query_by=name&filter_by=price:%3C20" > search.json
python3 - <<'PYSEARCH'
import json
from pathlib import Path
result = json.loads(Path('search.json').read_text())
assert result['found'] == 1
assert [x['document']['id'] for x in result['hits']] == ['coffee-1']
print('Search returned the expected product; keep the collection name for readback.')
PYSEARCH
The gateway reads the per-instance native API key from a private server file. Customer requests use the installed helper and its private client identity; do not print or copy the native key into commands. Delete only your own named test collection after you have finished verifying it.
Package limits. Single-node text search, filters and facets. No managed cluster, high availability or preconfigured vector model. CLIP embedding models are not included in this build and are rejected. Native API and peering ports remain bound to loopback. Data size, memory usage and backups are the operator’s responsibility.
These instructions describe this package’s API and defaults. General upstream examples may use different endpoints or include features outside this package. The fuller walkthrough and installed operating notes are in /opt/sushi/docs/DEMO.md and /opt/sushi/docs/README.md.
Last updated October 18, 2026 · Suggest an improvement