1 files changed, 179 insertions, 0 deletions
diff --git a/hosts/poweredge-pro/searxng.nix b/hosts/poweredge-pro/searxng.nix
new file mode 100644
index 0000000..c05af03
--- /dev/null
+++ b/hosts/poweredge-pro/searxng.nix
@@ -0,0 +1,179 @@
+{ pkgs, ... }: {
+	containers.searxng = {
+		autoStart = true;
+		privateNetwork = true;
+		hostBridge = "br-lan0";
+		localMacAddress = "02:00:00:00:77:13";
+
+		config = { lib, config, ... }: let
+			environmentFile = "/run/searx/searxng.env";
+			generateEnvironmentFile = ''
+				umask 077
+				echo "SEARXNG_SECRET=$(head -c 56 /dev/urandom | base64)" > ${environmentFile}
+				ls /run/searx
+			'';
+		in {
+			# Network
+			networking.interfaces.eth0.useDHCP = true;
+			networking.firewall.allowedTCPPorts = [ 80 ];  # Nginx
+
+			# Generate secret key
+			systemd.services.searx-environment-file = {
+				description = "Generate environment file with secret key for searx";
+				wantedBy = [ "searx-init.service" ];
+				partOf   = [ "searx-init.service" ];
+				before   = [ "searx-init.service" ];
+				serviceConfig = {
+					Type = "oneshot";
+					RemainAfterExit = true;
+					User = "searx";
+					RuntimeDirectory = "searx";
+					RuntimeDirectoryMode = "750";
+					ConditionPathExists = "!${environmentFile}";
+				};
+				script = generateEnvironmentFile;
+			};
+
+			# Configure searxng
+			services.searx = {
+				enable = true;
+				redisCreateLocally = true;
+				#package = pkgs.unstable.searxng;
+				package = pkgs.searxng;
+				inherit environmentFile;  # Provides secret key
+
+				# Rate limiting
+				limiterSettings = {
+					real_ip = {
+						x_for = 1;
+						ipv4_prefix = 32;
+						ipv6_prefix = 56;
+					};
+
+					botdetection = {
+						ip_limit = {
+							filter_link_local = true;
+							link_token = true;
+						};
+					};
+				};
+
+				# UWSGI configuration
+				configureUwsgi = true;
+
+				uwsgiConfig = {
+					socket = "/run/searx/searx.sock";
+					http = "127.0.0.1:8888";
+					chmod-socket = "660";
+				};
+
+				settings = {
+					general = {
+						instance_name = "TJK Search";
+						donation_url = "https://tjkeller.xyz";
+						enable_metrics = false;
+					};
+
+					ui = {
+						static_use_hash = true;
+						default_locale = "en";
+						query_in_title = true;
+						infinite_scroll = false;
+						center_alignment = true;
+						hotkeys = "vim";
+					};
+
+					server = {
+						port = 8888;
+						bind_address = "127.0.0.1";
+						method = "GET";
+						secret_key = "@SEARX_SECRET_KEY@";  # Reference external secret key
+						limiter = true;
+					};
+
+					# Search engine settings
+					search = {
+						safe_search = 2;  # Strict
+						autocomplete = "";
+						default_lang = "en-US";
+					};
+
+					preferences.lock = [ "safesearch" ];  # Lock safe_search at strict
+
+					# https://docs.searxng.org/admin/plugins.html
+					enabled_plugins = [
+						"Tor check plugin"
+						"Tracker URL remover"
+						"Basic Calculator"
+						"Unit converter plugin"
+						"Hash plugin"
+						"Self Information"
+						"Open Access DOI rewrite"
+						"Hostnames plugin"
+					];
+
+					hostnames.replace = {
+						"(.*\.)?youtube\.com$" = "yt.tjkeller.xyz";
+						"(.*\.)?youtu\.be$" = "yt.tjkeller.xyz";
+						#"(.*\.)?reddit\.com$" = "old.reddit.com";
+					};
+
+					# Enable / disabled search engines from default list
+					engines = lib.mapAttrsToList (name: value: { inherit name; disabled = !value; }) {
+						# General
+						"mojeek" = true;
+						"qwant" = true;
+						"bing" = true;
+
+						# Images
+						"artic" = false;
+						"deviantart" = false;
+						"flickr" = false;
+						"library of congress" = false;
+						"openverse" = false;
+						"pinterest" = false;
+						"public domain image archive" = false;
+						"unsplash" = false;
+						"wallhaven" = false;
+						"wikicommons.images" = false;
+
+						# Videos
+						"bitchute" = true;
+						"dailymotion" = false;
+						"piped" = false;
+						"rumble" = true;
+						"sepiasearch" = false;
+						"vimeo" = false;
+						"wikicommons.videos" = false;
+
+						# Music
+						"piped.music" = false;
+
+						# Files
+						"1337x" = true;
+						"annas archive" = true;
+						"library genesis" = true;
+
+						# Apps
+						"fdroid" = true;
+					};
+				};
+			};
+
+			# Nginx configuration
+			users.users.nginx.extraGroups = [ "searx" ];  # Allow access to uwsgi socket with 660 permissions
+			services.nginx = {
+				enable = true;
+				virtualHosts."searx" = {
+					default = true;
+					serverName = "_";  # Catchall
+					locations."/".extraConfig = ''
+						uwsgi_pass unix:${config.services.searx.uwsgiConfig.socket};
+					'';
+				};
+			};
+
+			system.stateVersion = "26.05";
+		};
+	};
+}