diff options
| -rw-r--r-- | hosts/poweredge-pro/configuration.nix | 7 | ||||
| -rw-r--r-- | hosts/poweredge-pro/dhcp-hosts.nix | 1 | ||||
| -rw-r--r-- | hosts/poweredge-pro/searxng.nix | 63 |
3 files changed, 60 insertions, 11 deletions
diff --git a/hosts/poweredge-pro/configuration.nix b/hosts/poweredge-pro/configuration.nix index 53f2599..23b16f8 100644 --- a/hosts/poweredge-pro/configuration.nix +++ b/hosts/poweredge-pro/configuration.nix @@ -1,10 +1,11 @@ { config, lib, pkgs, ... }: { imports = [ + ./dns.nix + ./filebrowser.nix + ./fileshares.nix ./key.nix ./networking.nix - ./fileshares.nix - ./filebrowser.nix - ./dns.nix + ./searxng.nix ]; # Setup bootloader diff --git a/hosts/poweredge-pro/dhcp-hosts.nix b/hosts/poweredge-pro/dhcp-hosts.nix index 643ae10..3f97e29 100644 --- a/hosts/poweredge-pro/dhcp-hosts.nix +++ b/hosts/poweredge-pro/dhcp-hosts.nix @@ -12,6 +12,7 @@ let mailcow = { macAddress = "00:a0:98:79:20:a2"; staticIp = "192.168.77.7"; }; tjkeller = { macAddress = "00:a0:98:62:cf:86"; staticIp = "192.168.77.8"; }; filebrowser = { macAddress = "02:00:00:00:77:12"; staticIp = "192.168.77.12"; }; + searxng = { macAddress = "02:00:00:00:77:13"; staticIp = "192.168.77.13"; }; WIN-BGBGC27B1PF = { macAddress = "d8:9e:f3:1c:f0:1c"; staticIp = "192.168.77.30"; }; # DACS DESKTOP-CQ4UIF9 = { macAddress = "08:bf:b8:3f:bd:48"; staticIp = "192.168.77.31"; }; # Kyle WIN-6FVMAFOID4G = { macAddress = "00:a0:98:58:10:85"; staticIp = "192.168.77.33"; }; # QB diff --git a/hosts/poweredge-pro/searxng.nix b/hosts/poweredge-pro/searxng.nix index cc5dfaf..c05af03 100644 --- a/hosts/poweredge-pro/searxng.nix +++ b/hosts/poweredge-pro/searxng.nix @@ -1,11 +1,11 @@ -{ +{ pkgs, ... }: { containers.searxng = { autoStart = true; privateNetwork = true; hostBridge = "br-lan0"; - localMacAddress = "02:00:00:00:00:05"; + localMacAddress = "02:00:00:00:77:13"; - config = { pkgs, lib, config, ... }: let + config = { lib, config, ... }: let environmentFile = "/run/searx/searxng.env"; generateEnvironmentFile = '' umask 077 @@ -15,6 +15,7 @@ in { # Network networking.interfaces.eth0.useDHCP = true; + networking.firewall.allowedTCPPorts = [ 80 ]; # Nginx # Generate secret key systemd.services.searx-environment-file = { @@ -37,16 +38,32 @@ services.searx = { enable = true; redisCreateLocally = true; + #package = pkgs.unstable.searxng; package = pkgs.searxng; inherit environmentFile; # Provides secret key - openFirewall = true; + + # Rate limiting + limiterSettings = { + real_ip = { + x_for = 1; + ipv4_prefix = 32; + ipv6_prefix = 56; + }; + + botdetection = { + ip_limit = { + filter_link_local = true; + link_token = true; + }; + }; + }; # UWSGI configuration - runInUwsgi = true; + configureUwsgi = true; uwsgiConfig = { socket = "/run/searx/searx.sock"; - http = ":8888"; + http = "127.0.0.1:8888"; chmod-socket = "660"; }; @@ -57,9 +74,21 @@ enable_metrics = false; }; + ui = { + static_use_hash = true; + default_locale = "en"; + query_in_title = true; + infinite_scroll = false; + center_alignment = true; + hotkeys = "vim"; + }; + server = { - port = 8080; - bind_address = "0.0.0.0"; + port = 8888; + bind_address = "127.0.0.1"; + method = "GET"; + secret_key = "@SEARX_SECRET_KEY@"; # Reference external secret key + limiter = true; }; # Search engine settings @@ -91,6 +120,11 @@ # Enable / disabled search engines from default list engines = lib.mapAttrsToList (name: value: { inherit name; disabled = !value; }) { + # General + "mojeek" = true; + "qwant" = true; + "bing" = true; + # Images "artic" = false; "deviantart" = false; @@ -126,6 +160,19 @@ }; }; + # Nginx configuration + users.users.nginx.extraGroups = [ "searx" ]; # Allow access to uwsgi socket with 660 permissions + services.nginx = { + enable = true; + virtualHosts."searx" = { + default = true; + serverName = "_"; # Catchall + locations."/".extraConfig = '' + uwsgi_pass unix:${config.services.searx.uwsgiConfig.socket}; + ''; + }; + }; + system.stateVersion = "26.05"; }; }; |