Index: /gs3-extensions/solr/trunk/src/gs3-setup.bat
===================================================================
--- /gs3-extensions/solr/trunk/src/gs3-setup.bat	(revision 32431)
+++ /gs3-extensions/solr/trunk/src/gs3-setup.bat	(revision 32432)
@@ -12,9 +12,13 @@
 :: sets the SOLR_PORT and SOLR_HOST to the values of tomcat.port and tomcat.host properties
 
-set SOLR_PORT=8983
-set SOLR_HOST=localhost
+set SOLR_PORT=8383
+set SOLR_HOST=127.0.0.1
 
 setlocal enabledelayedexpansion
 set FOUNDPROPS=
+:: The Solr servlet should only be locally accessible, thus restricting the protocol to http as
+:: https certificates can't be issued for localhost/127.0.0.1 (https://letsencrypt.org/docs/certificates-for-localhost/)
+:: This means we use the properties localhost.server.http (defaults to 127.0.0.1) and localhost.port.http 
+:: to construct the solr servlet url, rather than properties tomcat.server and tomcat.port.https
 :: Loosely based on 
 :: http://stackoverflow.com/questions/7708681/how-to-read-from-a-properties-file-using-batch-script 
@@ -24,6 +28,6 @@
 :: for alternative suggestions useful in other instances
 FOR /F "usebackq tokens=1,2 delims==" %%G IN ("%GSDL3SRCHOME%\build.properties") DO ( 
-	if "%%G"=="tomcat.server" set SOLR_HOST=%%H& set FOUNDPROPS=!FOUNDPROPS!found
-	if "%%G"=="tomcat.port" set SOLR_PORT=%%H& set FOUNDPROPS=!FOUNDPROPS!found
+	if "%%G"=="localhost.server.http" set SOLR_HOST=%%H& set FOUNDPROPS=!FOUNDPROPS!found
+	if "%%G"=="localhost.port.http" set SOLR_PORT=%%H& set FOUNDPROPS=!FOUNDPROPS!found
 	:: break out of the loop as soon as both properties are found
 	if "!FOUNDPROPS!" == "foundfound" goto foundall
Index: /gs3-extensions/solr/trunk/src/gs3-setup.sh
===================================================================
--- /gs3-extensions/solr/trunk/src/gs3-setup.sh	(revision 32431)
+++ /gs3-extensions/solr/trunk/src/gs3-setup.sh	(revision 32432)
@@ -15,12 +15,16 @@
 # The following sets the field separator IFS to the = sign, then reads the file line by 
 # line, setting propname and propval (which are fields separated by '=') for each line read
-SOLR_PORT=8983
-SOLR_HOST=localhost
+SOLR_PORT=8383
+SOLR_HOST=127.0.0.1
 file=$GSDL3SRCHOME/build.properties
+# The Solr servlet should only be locally accessible, thus restricting the protocol to http as
+# https certificates can't be issued for localhost/127.0.0.1 (https://letsencrypt.org/docs/certificates-for-localhost/)
+# This means we use the properties localhost.server.http (defaults to 127.0.0.1) and localhost.port.http 
+# to construct the solr servlet url, rather than properties tomcat.server and tomcat.port.https
 while IFS== read propname propval; do
-    if [ "x$propname" = "xtomcat.server" ] ; then
+    if [ "x$propname" = "xlocalhost.server.http" ] ; then
 	SOLR_HOST=$propval
     fi
-    if [ "x$propname" = "xtomcat.port" ] ; then
+    if [ "x$propname" = "xlocalhost.port.http" ] ; then
 	SOLR_PORT=$propval
     fi          
Index: /main/trunk/greenstone2/perllib/servercontrol.pm
===================================================================
--- /main/trunk/greenstone2/perllib/servercontrol.pm	(revision 32431)
+++ /main/trunk/greenstone2/perllib/servercontrol.pm	(revision 32432)
@@ -385,8 +385,10 @@
     # For GS2, we derive the URL from the llssite.cfg file.
 
-	my $url = &util::get_full_greenstone_url_prefix($gs_mode, $lib_name); # found largely identical method copied
-			# into util. Don't want duplicates, so calling that from here.
-	
-	# either the url is still undef or it is now set
+    # note that unless we pass in $get_public_url=1, we now get the local http URL
+    # by default (e.g. http://127.0.0.1:httpPort/greenstone/library)
+    my $url = &util::get_full_greenstone_url_prefix($gs_mode, $lib_name); # found largely identical method copied
+		# into util.pm. Don't want duplicates, so calling that from here.
+	
+    # either the url is still undef or it is now set
     #print STDERR "\n@@@@@ final URL:|$url|\n" if $url;		
     #print STDERR "\n@@@@@ URL still undef\n" if !$url;
Index: /main/trunk/greenstone2/perllib/util.pm
===================================================================
--- /main/trunk/greenstone2/perllib/util.pm	(revision 32431)
+++ /main/trunk/greenstone2/perllib/util.pm	(revision 32432)
@@ -1292,10 +1292,13 @@
 #
 # Designed to work with a server included with GS.
-#  - For GS3, we ask ant for the library URL.
 #  - For GS2, we derive the URL from the llssite.cfg file.
+#  - For GS3, we ask ant for the library URL. For GS3, we get the local *http* URL
+# by default, something like http://127.0.0.1:<httpPort>/greenstone3/library).
+# Pass in $get_public_url=1 to get something like
+# <default.protocol>://<tomcat.server>:<default.port>/greenstone/library
 
 sub get_full_greenstone_url_prefix
 {	
-	my ($gs_mode, $lib_name) = @_;
+	my ($gs_mode, $lib_name, $get_public_url) = @_;
 	
     # if already set on a previous occasion, just return that
@@ -1371,5 +1374,5 @@
 	# app.name is stored in app.path by build.xml. Need to move app.name in build.properties from build.xml
 	
-	# Or, run the new target get-default-servlet-url
+	# Or, run the new target get-local-http-servlet-url / get-default-servlet-url
 	# the output can look like:
 	#
@@ -1385,12 +1388,14 @@
 	# - see http://stackoverflow.com/questions/799968/whats-the-difference-between-perls-backticks-system-and-exec
 	
-	# The get-default-servlet-url ant target can be run from anywhere by specifying the
+	# The get-local-http-servlet-url (or get-default-servlet-url) ant target can be run from anywhere by specifying the
 	# location of GS3's ant build.xml buildfile. Activate.pl can be run from anywhere for GS3
 	# GSDL3SRCHOME will be set for GS3 by gs3-setup.sh, a step that would have been necessary
 	# to run the activate.pl script in the first place
 	
+	# The default is to get-local-http-servlet-url (of the form http://127.0.0.1:<httpPort>/greentone3/library)
 	my $full_build_xml = &FileUtils::javaFilenameConcatenate($ENV{'GSDL3SRCHOME'},"build.xml");
 
-	my $perl_command = "ant -buildfile \"$full_build_xml\" get-default-servlet-url";
+	my $perl_command = $get_public_url ? "get-default-servlet-url" : "get-local-http-servlet-url";
+	$perl_command = "ant -buildfile \"$full_build_xml\" $perl_command";	
 	
 	if (open(PIN, "$perl_command |")) {
Index: /main/trunk/greenstone3/build.properties.svn
===================================================================
--- /main/trunk/greenstone3/build.properties.svn	(revision 32431)
+++ /main/trunk/greenstone3/build.properties.svn	(revision 32432)
@@ -36,4 +36,9 @@
 # (on the hostname denoted by tomcat.server at the port number denoted by localhost.port.http)
 localhost.port.http=8383
+
+# The local server host address. Since 127.0.0.1 is safer than localhost,
+# leave this property as-is unless your local loopback address is not 127.0.0.1.
+# See also https://letsencrypt.org/docs/certificates-for-localhost/
+localhost.server.http=127.0.0.1
 
 # Tomcat's shutdown port - this may need to be changed if you are running two or more Tomcats
Index: /main/trunk/greenstone3/build.xml
===================================================================
--- /main/trunk/greenstone3/build.xml	(revision 32431)
+++ /main/trunk/greenstone3/build.xml	(revision 32432)
@@ -258,5 +258,7 @@
     But 'localhost' (or actually, 127.0.0.1) needed for solr: solr servlet not accessible to outside world 
     -->
-    <property name="local.http.url" value="http://127.0.0.1:${localhost.port.http}"/>
+    <condition property="local.http.url" value="http://${localhost.server.http}" else="http://${localhost.server.http}:${localhost.port.http}">
+      <equals arg1="${localhost.port.http}" arg2="80" trim="true"/>
+    </condition>
 
 	<!-- On linux, if testing https certification, pass in minus-minus-staging. If not testing on linux, nothing extra to pass in.
@@ -1038,10 +1040,20 @@
   </target>
 
+  <!-- returns the base local URL, something like HTTP://127.0.0.1:<HTTPport>
+       or some sane equivalent for 127.0.0.1 -->
+  <target name="get-local-base-http-url">
+    <echo>${local.http.url}</echo>
+  </target>
+  <!-- Returns something like HTTP://127.0.0.1:<HTTPport>/greenstone3/library -->
+  <target name="get-local-http-servlet-url">
+    <echo>${local.http.url}${app.path}${server.default.servlet}</echo>
+  </target>
+
   <!-- solr should only be accessible locally, which therefore also means only over http.
-  But for http,  use 127.0.0.1 instead of localhost (as localhost can be mapped to something other than 127.0.0.1
-  and is therefore not safe). See https://letsencrypt.org/docs/certificates-for-localhost/ -->
+  Note that for http, 127.0.0.1 is safer than localhost (as localhost can be mapped to something
+  other than 127.0.0.1). See also https://letsencrypt.org/docs/certificates-for-localhost/ -->
   <target name="get-solr-servlet-url">
     <!--<echo>${default.server.protocol}://${tomcat.server}:${default.tomcat.port}/${solr.context}</echo>-->
-    <echo>http://127.0.0.1:${localhost.port.http}/${solr.context}</echo>
+    <echo>${local.http.url}/${solr.context}</echo>
   </target>
 
@@ -1544,4 +1556,5 @@
     <filter token="tomcat.server" value="${tomcat.server}"/>
     <filter token="default.tomcat.port" value="${default.tomcat.port}"/>
+    <filter token="localhost.server.http" value="${localhost.server.http}"/>
     <filter token="localhost.port.http" value="${localhost.port.http}"/>
     <filter token="tomcat.port.https" value="${tomcat.port.https}"/>    
@@ -1738,4 +1751,6 @@
 		
 		In this case "fullchain_and_prvtkey.pfx" is generated, which is the windows value of ${keystore.file} property
+
+		Helpful for debugging: https://stackoverflow.com/questions/10302489/ant-script-have-exec-tag-dump-out-entire-command-line
 		-->
     <exec executable="cmd" osfamily="windows" dir="${basedir}/bin/${os.bin.dir}" spawn="false">
@@ -1812,5 +1827,6 @@
       <!-- Finally, mkdir ${packages.home}/tomcat/conf/https_cert
 	   and copy the file /tmp/${tomcat.server}_fullchain_and_key.p12 into it
-	   and rename to a slightly shorter and simpler name. 
+	   and rename to a slightly shorter and simpler name,
+	   see https://stackoverflow.com/questions/8971187/ant-renaming-while-copying-file
 	   The file in tmp has root permissions. But copying it from tmp into
 	   the local account will give the copy local account permissions.
Index: /main/trunk/greenstone3/resources/web/global.properties.svn
===================================================================
--- /main/trunk/greenstone3/resources/web/global.properties.svn	(revision 32431)
+++ /main/trunk/greenstone3/resources/web/global.properties.svn	(revision 32432)
@@ -26,5 +26,5 @@
 tomcat.port.https=@tomcat.port.https@
 localhost.protocol.http=http
-localhost.server.http=127.0.0.1
+localhost.server.http=@localhost.server.http@
 localhost.port.http=@localhost.port.http@
 restrict.http.to.local=@restrict.http.to.local@
Index: /main/trunk/greenstone3/src/java/org/greenstone/util/GlobalProperties.java
===================================================================
--- /main/trunk/greenstone3/src/java/org/greenstone/util/GlobalProperties.java	(revision 32431)
+++ /main/trunk/greenstone3/src/java/org/greenstone/util/GlobalProperties.java	(revision 32432)
@@ -224,5 +224,5 @@
 			String httpPort = properties.getProperty("localhost.port.http");
 			localhost_http_web_address = properties.getProperty("localhost.protocol.http") + "://"
-			    + properties.getProperty("localhost.server.http") // always uses 127.0.0.1 (not localhost, which can be modified and is therefore unsafe!)
+			    + properties.getProperty("localhost.server.http", "127.0.0.1") // likely to be 127.0.0.1 rather than localhost, since localhost can be modified and is therefore unsafe
 			    + httpPort;
 
Index: /main/trunk/greenstone3/src/java/org/greenstone/util/ProtocolPortProperties.java
===================================================================
--- /main/trunk/greenstone3/src/java/org/greenstone/util/ProtocolPortProperties.java	(revision 32431)
+++ /main/trunk/greenstone3/src/java/org/greenstone/util/ProtocolPortProperties.java	(revision 32432)
@@ -60,4 +60,5 @@
     private boolean supportsHttps = false;
     private String defaultPortPropertyName = "localhost.port.http";
+    private String localHttpURL;
 
     // default protocol if multiple supported
@@ -86,13 +87,9 @@
     public boolean hadError() { return errorCode != ALL_CORRECT; }
 
-    // Use 127.0.0.1 instead of localhost since localhost is unsafe (can be mapped
-    // to something other than 127.0.0.1). See https://letsencrypt.org/docs/certificates-for-localhost/
+    // returns the local http base URL, something like http://127.0.0.1:<httpPort>
     public String getLocalHttpBaseAddress() {
-	// httpPort is set during the constructor, 
-	// so knowing httpPort, we can set the internal/local access http URL:
-	String portSuffix = httpPort.equals("80") ? "" : (":"+httpPort);
-	return "http://127.0.0.1"+portSuffix;
-	
+	return localHttpURL;	
     }
+
 
     // Constructor that will throw an Exception on ports/protocol configuration error or inconsistency
@@ -116,4 +113,13 @@
 	}
 	
+	// Setting the internal/local access url, which has to be over http (see
+	// https://letsencrypt.org/docs/certificates-for-localhost/)
+	// localhost.server.http defaults to 127.0.0.1 instead of localhost, since
+	// localhost is unsafe as it can be mapped to something other than 127.0.0.1.
+	localHttpURL = "http://" + props.getProperty("localhost.server.http", "127.0.0.1");
+	if(!httpPort.equals("80")) {
+	    localHttpURL = localHttpURL + ":" + httpPort;
+	}
+
 	String supportedProtocols = props.getProperty("server.protocols");
 	if(supportedProtocols == null || supportedProtocols.equals("")) {
