traefik: init searxng

hosts/arashi/services/redis.nix

@@ -13,5 +13,17 @@
         protected-mode = "no";
       };
     };
+    searxng = {
+      enable = true;
+      openFirewall = true;
+      port = 6380;
+      bind = null;
+      databases = 16;
+      logLevel = "debug";
+      requirePass = "searxng";
+      settings = {
+        protected-mode = "no";
+      };
+    };
   };
 }

hosts/sora/services/traefik.nix

@@ -18,7 +18,6 @@
             rule = "HostSNI(`*`)";
             entrypoints = ["gitssh"];
             service = "gitssh";
-            tls.passthrough = true;
           };
         };
       };
@@ -105,8 +104,16 @@
             tls.domains = [{main = "*.flake.sh";}];
             tls.certresolver = "production";
           };
+          searxng = {
+            rule = "Host(`search.flake.sh`)";
+            entrypoints = ["websecure"];
+            service = "searxng";
+            tls.domains = [{main = "*.flake.sh";}];
+            tls.certresolver = "production";
+          };
         };
         services = {
+          gitssh.loadBalancer.servers = [{url = "tcp://100.121.201.47:2222";}];
           uptime-kuma.loadBalancer.servers = [{url = "http://100.87.54.48:4000";}];
           gotify.loadBalancer.servers = [{url = "http://100.87.54.48:3000";}];
           conduit.loadBalancer.servers = [{url = "http://100.121.201.47:6167";}];
@@ -117,7 +124,7 @@
           grafana.loadBalancer.servers = [{url = "http://100.121.201.47:3100";}];
           hedgedoc.loadBalancer.servers = [{url = "http://100.121.201.47:3300";}];
           vaultwarden.loadBalancer.servers = [{url = "http://100.121.201.47:8222";}];
-          gitssh.loadBalancer.servers = [{url = "tcp://100.121.201.47:2222";}];
+          searxng.loadBalancer.servers = [{url = "http://100.110.140.130:8100";}];
         };
       };
     };

hosts/yuki/services/searxng.nix

@@ -1,14 +1,43 @@
-_: {
-  virtualisation.oci-containers.containers.searxng = {
-    image = "searxng/searxng:2023.6.10-5f11155c";
-    volumes = [
-      "/home/notoh/docker/searxng:/etc/searxng:rw"
-    ];
-    environment = {
-      INSTANCE_NAME = "SearXNG";
+{
+  pkgs,
+  config,
+  ...
+}: {
+  sops.secrets.searxng-secret = {};
+  networking.firewall.allowedTCPPorts = [8100];
+  services.searx = {
+    package = pkgs.searxng;
+    enable = true;
+    environmentFile = config.sops.secrets.searxng-secret.path;
+    settings = {
+      general = {
+        debug = false;
+        instance_name = "SearXNG flake.sh";
+        enable_metrics = false;
+        contact_url = "mailto:contact@notohh.dev";
+      };
+      ui = {
+        default_theme = "simple";
+        theme_args = {
+          simple_style = "dark";
+        };
+      };
+      search = {
+        autocomplete = "google";
+        safe_search = 0;
+        default_lang = "en-US";
+      };
+      server = {
+        port = 8100;
+        bind_address = "0.0.0.0";
+        secret_key = "@SEARXNG_SECRET@";
+        base_url = "https://search.flake.sh/";
+        public_instance = true;
+        infinite_scroll = true;
+      };
+      redis = {
+        url = "redis://:searxng@100.94.214.100:6380";
+      };
     };
-    ports = [
-      "8100:8080"
-    ];
   };
 }

hosts/yuki/services/traefik.nix

@@ -15,11 +15,6 @@ _: {
             entrypoints = ["web"];
             service = "homarr";
           };
-          searxng = {
-            rule = "Host(`searxng.internal.flake.sh`)";
-            entryPoints = ["web"];
-            service = "searxng";
-          };
           stash = {
             rule = "Host(`stash.internal.flake.sh`)";
             entrypoints = ["web"];
@@ -45,7 +40,6 @@ _: {
           stash.loadBalancer.servers = [{url = "http://localhost:9999";}];
           homarr.loadBalancer.servers = [{url = "http://localhost:7575";}];
           dashdot.loadBalancer.servers = [{url = "http://localhost:4000";}];
-          searxng.loadBalancer.servers = [{url = "http://localhost:8100";}];
           jellyfin.loadBalancer.servers = [{url = "http://localhost:8096";}];
           jellyseerr.loadBalancer.servers = [{url = "http://localhost:5055";}];
         };

secrets/secrets.yaml

@@ -12,6 +12,7 @@ tsauth-sora: ENC[AES256_GCM,data:3jzPB0whb9xHudVl/MhNeCUgjDfzzQpxGJGqfMf2GqEtfEk
 tsauth-sakura: ENC[AES256_GCM,data:iN77ArKDnltxrWGCz8bMqMHBAp45oGUk+n5ilAE0tY2rz01PGaCmIgPFSDfNaMphH6gX+AbEd5Y=,iv:k/lBIZW7aKT3u+dgcFnQORah2yHZXAmY+PBv53tM1ao=,tag:9/pebj3D9LURTedqkduoaw==,type:str]
 forgejo-runner-token: ENC[AES256_GCM,data:uHwIBG2Ktdhs2nhfbidHSEkv7bwLnWzHZEa01sfnv2oYvtlHdnTXJQ==,iv:IRS+qLbIFl5GXxChogs6yxsUD4MxnjCw2VF3dxCvSnI=,tag:elTaJSO1ex4qrF9Wu8gx2A==,type:str]
 basegbot-runner-token: ENC[AES256_GCM,data:2ZnyRdou8U7SPYgntnzoibxOoQltUCnzXIMVYiPQj9Qfa3vaT6SY6w==,iv:RS66X1ophQDl1Mph0x0yzJb/v1x2o7d5+Z1FJRAXsSA=,tag:4wOI4fHkOGE8r1FsAoy+aw==,type:str]
+searxng-secret: ENC[AES256_GCM,data:SSvspQVRp79zJq0hzaqzuJIWFtVUoaqHGH9PXUViiXb9UKJM34t82o2J5K69RcOSBL7HadqmxcT4Eh8e8ZUJnquD7rrPdWb2Ih4zS7MmG94=,iv:wrQNNU7CjzfePNe1tWEXmN30vC0jTp+PtgfI3/XH22g=,tag:QAt/QL846hLLIMLQZUM3mQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -27,8 +28,8 @@ sops:
             YWNQcURKMSs2U0pOa3E0cTdCZ3RnalkKGayA7DBUQS+kn+6OYVBc6oTunF0qeZdt
             5b9DLHgh0HRWFm09XGSOog8K315d93Wzblw1My1/dXeEQX/ryinqUQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-10-08T03:17:36Z"
-    mac: ENC[AES256_GCM,data:l+CNLRubxiyHpkI4vf1+/8Uk8iKrAebFrPiMn4Cr5k4uQZAA5dXIdyMkUzxxVo0drlSDC4dBgji+6Cd85nKutfo9oqFCXTOj80ZM/WfUl+Rb0PUpZy7CG1u95y6npu4lD34SNXCspraXFHEE00ziuc70YksGJd2m+gCz7GFY3c8=,iv:7gacwYd0a/c4R3IaCAOUg7kl+Be1N2CFnZiXiBh4PbY=,tag:QPev8mRYUxgXJlOIfQ1QFw==,type:str]
+    lastmodified: "2023-10-10T19:01:17Z"
+    mac: ENC[AES256_GCM,data:R+UqQiqRkLfFNcB8M1TkIpCLswnOubHeweTsFrAcwNccPSVHkLZkUnLZet4EiPJwZ3Ss4h66aFeR5bL5Z+MvR99Fr3x2rZusM1FGlPFK2gf0GdpboRq5BsJ93N1yTux5geDqyX502XK3TA1/HruN72Hor7b+9PxVOAkBEdb/MW0=,iv:RS2FMtqxvenTG9GYwlS/L8r2nuDUmkkdscXI+d8KRcY=,tag:pDJY0dSfCxMPS/oHU2yylg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.0