**es-public-proxy**: Elasticsearch API proxy intended to be exposed to the
public internet (or any non-localhost clients) for safe read-only queries

This is intended as a simple alternative to other "read-only" plugins or
authentication solutions for elasticsearch. A benefit of keeping the
elasticsearch API itself, instead of building a application-layer wrapper, is
that there already exist client libraries, tools, and integrations in many
languages.

Plan:

- single Rust executable
- fast and simple enough to never impact performance or latency
- TOML configuration
- some modern async/await framework
- use official elasticsearch crate? or just reqwest?
- small subset of total public API: get, search, scroll
- per-index permissions
- return response bodies untouched
- parse queries with serde JSON, then re-serialize

Stretch or future goals:

- parsing Lucene `query_string`
- provide an alternate simpler API
- query caching
- index aliases and routing
- version mapping (eg, expose 7.x API for 6.x index)

Non-features:

- TLS (use a general purpose reverse proxy)

## Deployment

The imagined use case is that you have elasticsearch proper listening only to
localhost connections with plain HTTP. This makes adminstration easy from
authenticated local UNIX users. No non-localhost connections to elasticsearch
are allowed, even from trusted clients. This daemon runs as a small sidecar
proxy on localhost, listening on a public port. All non-localhost clients
direct queries through the proxy, which parses the query, ensures it is "safe",
then passes through to backend.