dank/command-center
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(web-research): the search egress re-read from the live boxes

Browse Source 
Two pages described Dankclaw's search stack from memory, and one of them invented a port.

`searxng-tuning.md` claimed "`:8081` (UI) / `:8082` (JSON API)". Re-probed 2026-10-21: JSON is
served on **8081** (`/search?q=…&format=json` returns results) and **8082 is not SearXNG at
all** — it publishes container port 8085, which is Marreta's nginx, moved off 8080 because
SearXNG owns that port inside the shared namespace. Four containers print the same port list in
`podman ps` because they share gluetun's namespace, which is exactly the detail that gets
mistaken for "the JSON API is on another port". The policy-drift flag now carries today's
reading: `/config` still reports 262 engines and zero disabled, unchanged since 2026-10-19, so
the tuned engine policy is still not live — still an operator decision, still not silently
re-applied.

`vpn-routing.md` gave a mullvad-shaped gluetun example and no fleet shape at all, while the
bundle's own work log says the manual-WireGuard law lives "on concept pages". It lives here now,
read from the running container: `VPN_SERVICE_PROVIDER=custom` + `VPN_TYPE=wireguard` + the
single-peer `WIREGUARD_*` names (`protonvpn` and the plural `WIREGUARD_PEERS_*` family are both
wrong for this image), `FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT=on` — whose name
is the warning that disabling it leaks egress while every check keeps passing — and
`tun0` present. The mullvad block stays as the generic illustration, now labelled as one.

Refs #64
This commit is contained in:
Frank
2026-10-21 02:19:23 -07:00
parent c37ad6e870
commit fb36a1b0fd
2 changed files with 45 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
omp-docs/agentic-web-research/searxng-tuning.md
+17 -15
View File
@@ -8,7 +8,7 @@ tags:
- privacy
- configuration
- unverified
verified: 2026-10-19
verified: 2026-10-21
timestamp: 2026-08-11
resource: https://docs.searxng.org
---
@@ -23,25 +23,27 @@ Compose (or Podman Quadlet) with a Valkey container.
This page lists the settings that matter for speed, privacy, and useful results.
> **Fleet instance:** the harness `web/searxng` provider calls the instance at
> `192.168.0.143:8081` (UI) / `:8082` (JSON API) on dankclaw. The pi-era
> [Pi Web Access](../pi/packages/pi-web-access.md) called the same host.
> **Fleet instance:** the harness `web/searxng` provider calls
> `192.168.0.143:8081` on dankclaw — HTML **and** JSON on that one port
> (`/search?q=…&format=json`, re-probed 2026-10-21). Port **8082 is not a second SearXNG
> API**: it publishes container port 8085, which is Marreta's nginx (moved off 8080 because
> SearXNG owns it in that namespace). Both ports show up against four container names because
> `searxng`, `searxng-valkey`, `gluetun` and the `marreta` pair share one network namespace.
> The pi-era [Pi Web Access](../pi/packages/pi-web-access.md) called the same host.
## Live instance (probed 2026-10-19)
## Live instance (probed 2026-10-21)
User Quadlet stack on dankclaw: `searxng.container`
(`ghcr.io/searxng/searxng:latest`) + `searxng-valkey.container`
(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the
containers share its network namespace, which is why `podman ps` shows :8081/
:8082 on several names) + `marreta`/`marreta_browser`. `limiter.toml`: enabled,
`pass_searxng_org: true`.
(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the other containers
join its network namespace, hence the shared port list) + `marreta`/`marreta_browser`.
`limiter.toml`: enabled, `pass_searxng_org: true`.
**Policy drift flag:** this page's tuned engine policy (google and bing
disabled; DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on
2026-08-16) is NOT live: `/config` on 2026-10-19 reports all 262 engines
enabled, google and bing included. Either the settings override was lost in
the 2026-10 stack reinstatement or the policy was deliberately dropped.
Confirm with Frank before re-applying.
**Policy drift flag:** this page's tuned engine policy (google and bing disabled;
DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on 2026-08-16) is NOT live.
`/config` re-read 2026-10-21: 262 engines, **zero disabled**, google and bing included —
unchanged since 2026-10-19. Either the override was lost in the 2026-10 stack reinstatement or
the policy was deliberately dropped. Confirm with Frank before re-applying.
## Plan the Deployment
omp-docs/agentic-web-research/vpn-routing.md
+28 -3
View File
@@ -8,7 +8,7 @@ tags:
- networking
- proxy
- unverified
verified: 2026-08-28
verified: 2026-10-21
timestamp: 2026-08-19
resource: https://docs.searxng.org/admin/settings/settings_outgoing.html
---
@@ -19,7 +19,10 @@ SearXNG talks to many upstream engines. Some of them rate-limit or block the sou
This page gives four working patterns. Choose the one that matches how you run SearXNG.
> **Your setup:** SearXNG runs on another host at `192.168.0.143:8081` (dankclaw). Apply the Docker patterns on that host. The proxy pattern works from any host.
> **Fleet instance:** SearXNG runs on dankclaw (`192.168.0.143:8081`, HTML and JSON alike)
> inside gluetun's network namespace — Pattern 2 below, in Quadlet rather than Compose. The
> live shape is in [Fleet instance on dankclaw](#fleet-instance-on-dankclaw), read 2026-10-21.
> The proxy pattern (1) works from any host.
## The Goal
@@ -156,11 +159,33 @@ This pattern places the whole SearXNG process inside the tunnel namespace. The h
| Dedicated network | Medium | High | No |
| Inside VPN container | Medium | Highest | No |
## Fleet instance on dankclaw
Read from the running container 2026-10-21 (`podman inspect gluetun`, `podman ps`):
* **`VPN_SERVICE_PROVIDER=custom` with `VPN_TYPE=wireguard`.** The provider is Proton VPN,
configured as *manual* WireGuard: the single-peer `WIREGUARD_*` names
(`WIREGUARD_PRIVATE_KEY`, `WIREGUARD_PEER_PUBLIC_KEY`, `WIREGUARD_ENDPOINT_IP`) are what
gluetun reads. `VPN_SERVICE_PROVIDER=protonvpn` is wrong here, and so is the plural
`WIREGUARD_PEERS_*` family — that shape belongs to a different gluetun major.
* **One namespace, four names.** `searxng`, `searxng-valkey`, `marreta` and `marreta_browser`
join gluetun's network namespace, so `podman ps` prints the same published-port list against
all of them: `8081→8080` is SearXNG, `8082→8085` is Marreta's nginx, which moved off 8080
because SearXNG owns it inside that namespace.
* **`FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT=on`.** The name is the warning:
turning it off sends the container's egress out the plain internet while every "VPN is
configured" check keeps passing — results then quietly come from the host IP.
* **Health:** tunnel presence is `podman exec gluetun sh -c 'test -e /sys/class/net/tun0'`
(true on this box). gluetun ships no curl, so an egress-IP check needs a companion container
on its network — see [Verify the Route](#verify-the-route).
## Decisions That Matter
- A SOCKS proxy keeps the per-engine control. Use Pattern 1.
- Gluetun gives the cleanest full-tunnel setup. Use Pattern 2.
- Mullvad ships its own WireGuard keys for Gluetun.
* Copying an upstream example? Read the provider and env shape from
[Fleet instance on dankclaw](#fleet-instance-on-dankclaw) first: the mullvad-shaped block in
Pattern 2 is an illustration, not this fleet's config.
- An OpenVPN-only provider works with Pattern 3 or 4.
## Verify the Route