setup searxng

hosts/freun-dev/secrets.nix

@@ -32,6 +32,7 @@
           "voidauth"
           "gitea"
           "gitea-actions-runner"
+          "searx"
         ]
     )
     // {

hosts/freun-dev/services.nix

@@ -387,6 +387,44 @@ in
       };
     };
 
+    searx = {
+      enable = true;
+      subdomain = "q";
+      port = 3400;
+      environmentFile = secrets.searx.path;
+      settings = {
+        general = {
+          instance_name = "freun.dev SearXNG";
+        };
+        server = {
+          public_instance = true;
+          image_proxy = true;
+          method = "GET";
+          secret_key = "$SEARX_SECRET_KEY";
+        };
+        engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
+          "google".disabled = true;
+          "duckduckgo".disabled = false;
+          "duckduckgo images".disabled = false;
+          "wolframalpha".disabled = false;
+        };
+        search = {
+          formats = [
+            "html"
+            "json"
+          ];
+        };
+        enabled_plugins = [
+          "Basic Calculator"
+          "Hash plugin"
+          "Open Access DOI rewrite"
+          "Hostnames plugin"
+          "Unit converter plugin"
+          "Tracker URL remover"
+        ];
+      };
+    };
+
     webserver = {
       acme.dnsChallenge = true;
       tailscaleAuth.expectedTailnet = "tempel-vibes.ts.net";

modules/services/default.nix

@@ -33,5 +33,6 @@
     ./gitea.nix
     ./dhcp-dns-sync
     ./invidious-companion.nix
+    ./searx.nix
   ];
 }

modules/services/searx.nix

@@ -0,0 +1,70 @@
+{
+  pkgs-unstable,
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  cfg = config.services.searx;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  disabledModules = [ "services/networking/searx.nix" ];
+
+  imports = [
+    "${inputs.nixpkgs-unstable}/nixos/modules/services/networking/searx.nix"
+  ];
+
+  options.services.searx = {
+    port = lib.mkOption {
+      type = lib.types.int;
+    };
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.searx = {
+      redisCreateLocally = true;
+      package = pkgs-unstable.searxng;
+      limiterSettings = {
+        botdetection = {
+          ipv4_prefix = 32;
+          ipv6_prefix = 56;
+          ip_limit = {
+            filter_link_local = true;
+            link_token = false;
+          };
+          ip_lists = {
+            pass_ip = [
+              "127.0.0.1/32"
+              "::1"
+            ];
+          };
+          trusted_proxies = [
+            "127.0.0.0/8"
+            "::1"
+          ];
+        };
+      };
+      settings = {
+        server = {
+          bind_address = "localhost";
+          port = cfg.port;
+          limiter = true;
+        };
+      };
+    };
+
+    services.webserver.vHosts.${fqdn}.locations."/".proxyPort = cfg.port;
+
+    # searx expects limiter.toml in the same directory as settings.yml (/run/searx)
+    systemd.services.searx-init.script = lib.mkAfter ''
+      ln -sf /etc/searxng/limiter.toml /run/searx/limiter.toml
+    '';
+
+    users.groups.searx.members = [ "nginx" ];
+  };
+}

secrets/secrets.nix

@@ -46,6 +46,7 @@ in
   "gitea-actions-runner.age".publicKeys = users ++ [ freun-dev ];
   "invidious-companion.age".publicKeys = users ++ [ apu ];
   "invidious.age".publicKeys = users ++ [ freun-dev ];
+  "searx.age".publicKeys = users ++ [ freun-dev ];
   "everii-vpn/de1.key.age".publicKeys = users ++ [ radish ];
   "everii-vpn/ch1.key.age".publicKeys = users ++ [ radish ];
   "everii-vpn/fi1.key.age".publicKeys = users ++ [ radish ];