{ pkgs, ... }: {
	containers.searxng = {
		autoStart = true;
		privateNetwork = true;
		hostBridge = "br-lan0";
		localMacAddress = "02:00:00:00:77:13";

		config = { lib, config, ... }: let
			environmentFile = "/run/searx/searxng.env";
			generateEnvironmentFile = ''
				umask 077
				echo "SEARXNG_SECRET=$(head -c 56 /dev/urandom | base64)" > ${environmentFile}
				ls /run/searx
			'';
		in {
			# Network
			networking.interfaces.eth0.useDHCP = true;
			networking.firewall.allowedTCPPorts = [ 80 ];  # Nginx

			# Generate secret key
			systemd.services.searx-environment-file = {
				description = "Generate environment file with secret key for searx";
				wantedBy = [ "searx-init.service" ];
				partOf   = [ "searx-init.service" ];
				before   = [ "searx-init.service" ];
				serviceConfig = {
					Type = "oneshot";
					RemainAfterExit = true;
					User = "searx";
					RuntimeDirectory = "searx";
					RuntimeDirectoryMode = "750";
					ConditionPathExists = "!${environmentFile}";
				};
				script = generateEnvironmentFile;
			};

			# Configure searxng
			services.searx = {
				enable = true;
				redisCreateLocally = true;
				#package = pkgs.unstable.searxng;
				package = pkgs.searxng;
				inherit environmentFile;  # Provides secret key

				# Rate limiting
				limiterSettings = {
					real_ip = {
						x_for = 1;
						ipv4_prefix = 32;
						ipv6_prefix = 56;
					};

					botdetection = {
						ip_limit = {
							filter_link_local = true;
							link_token = true;
						};
					};
				};

				# UWSGI configuration
				configureUwsgi = true;

				uwsgiConfig = {
					socket = "/run/searx/searx.sock";
					http = "127.0.0.1:8888";
					chmod-socket = "660";
				};

				settings = {
					general = {
						instance_name = "TJK Search";
						donation_url = "https://tjkeller.xyz";
						enable_metrics = false;
					};

					ui = {
						static_use_hash = true;
						default_locale = "en";
						query_in_title = true;
						infinite_scroll = false;
						center_alignment = true;
						hotkeys = "vim";
					};

					server = {
						port = 8888;
						bind_address = "127.0.0.1";
						method = "GET";
						secret_key = "@SEARX_SECRET_KEY@";  # Reference external secret key
						limiter = true;
					};

					# Search engine settings
					search = {
						safe_search = 2;  # Strict
						autocomplete = "";
						default_lang = "en-US";
					};

					preferences.lock = [ "safesearch" ];  # Lock safe_search at strict

					# https://docs.searxng.org/admin/plugins.html
					enabled_plugins = [
						"Tor check plugin"
						"Tracker URL remover"
						"Basic Calculator"
						"Unit converter plugin"
						"Hash plugin"
						"Self Information"
						"Open Access DOI rewrite"
						"Hostnames plugin"
					];

					hostnames.replace = {
						"(.*\.)?youtube\.com$" = "yt.tjkeller.xyz";
						"(.*\.)?youtu\.be$" = "yt.tjkeller.xyz";
						#"(.*\.)?reddit\.com$" = "old.reddit.com";
					};

					# Enable / disabled search engines from default list
					engines = lib.mapAttrsToList (name: value: { inherit name; disabled = !value; }) {
						# General
						"mojeek" = true;
						"qwant" = true;
						"bing" = true;

						# Images
						"artic" = false;
						"deviantart" = false;
						"flickr" = false;
						"library of congress" = false;
						"openverse" = false;
						"pinterest" = false;
						"public domain image archive" = false;
						"unsplash" = false;
						"wallhaven" = false;
						"wikicommons.images" = false;

						# Videos
						"bitchute" = true;
						"dailymotion" = false;
						"piped" = false;
						"rumble" = true;
						"sepiasearch" = false;
						"vimeo" = false;
						"wikicommons.videos" = false;

						# Music
						"piped.music" = false;

						# Files
						"1337x" = true;
						"annas archive" = true;
						"library genesis" = true;

						# Apps
						"fdroid" = true;
					};
				};
			};

			# Nginx configuration
			users.users.nginx.extraGroups = [ "searx" ];  # Allow access to uwsgi socket with 660 permissions
			services.nginx = {
				enable = true;
				virtualHosts."searx" = {
					default = true;
					serverName = "_";  # Catchall
					locations."/".extraConfig = ''
						uwsgi_pass unix:${config.services.searx.uwsgiConfig.socket};
					'';
				};
			};

			system.stateVersion = "26.05";
		};
	};
}