From fb36a1b0fdf87b5070fe00d67047384e5992ca74 Mon Sep 17 00:00:00 2001 From: Frank Date: Wed, 21 Oct 2026 02:19:23 -0700 Subject: [PATCH] docs(web-research): the search egress re-read from the live boxes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two pages described Dankclaw's search stack from memory, and one of them invented a port. `searxng-tuning.md` claimed "`:8081` (UI) / `:8082` (JSON API)". Re-probed 2026-10-21: JSON is served on **8081** (`/search?q=…&format=json` returns results) and **8082 is not SearXNG at all** — it publishes container port 8085, which is Marreta's nginx, moved off 8080 because SearXNG owns that port inside the shared namespace. Four containers print the same port list in `podman ps` because they share gluetun's namespace, which is exactly the detail that gets mistaken for "the JSON API is on another port". The policy-drift flag now carries today's reading: `/config` still reports 262 engines and zero disabled, unchanged since 2026-10-19, so the tuned engine policy is still not live — still an operator decision, still not silently re-applied. `vpn-routing.md` gave a mullvad-shaped gluetun example and no fleet shape at all, while the bundle's own work log says the manual-WireGuard law lives "on concept pages". It lives here now, read from the running container: `VPN_SERVICE_PROVIDER=custom` + `VPN_TYPE=wireguard` + the single-peer `WIREGUARD_*` names (`protonvpn` and the plural `WIREGUARD_PEERS_*` family are both wrong for this image), `FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT=on` — whose name is the warning that disabling it leaks egress while every check keeps passing — and `tun0` present. The mullvad block stays as the generic illustration, now labelled as one. Refs #64 --- .../agentic-web-research/searxng-tuning.md | 32 ++++++++++--------- omp-docs/agentic-web-research/vpn-routing.md | 31 ++++++++++++++++-- 2 files changed, 45 insertions(+), 18 deletions(-) diff --git a/omp-docs/agentic-web-research/searxng-tuning.md b/omp-docs/agentic-web-research/searxng-tuning.md index e39734a..4724e68 100644 --- a/omp-docs/agentic-web-research/searxng-tuning.md +++ b/omp-docs/agentic-web-research/searxng-tuning.md @@ -8,7 +8,7 @@ tags: - privacy - configuration - unverified -verified: 2026-10-19 +verified: 2026-10-21 timestamp: 2026-08-11 resource: https://docs.searxng.org --- @@ -23,25 +23,27 @@ Compose (or Podman Quadlet) with a Valkey container. This page lists the settings that matter for speed, privacy, and useful results. -> **Fleet instance:** the harness `web/searxng` provider calls the instance at -> `192.168.0.143:8081` (UI) / `:8082` (JSON API) on dankclaw. The pi-era -> [Pi Web Access](../pi/packages/pi-web-access.md) called the same host. +> **Fleet instance:** the harness `web/searxng` provider calls +> `192.168.0.143:8081` on dankclaw — HTML **and** JSON on that one port +> (`/search?q=…&format=json`, re-probed 2026-10-21). Port **8082 is not a second SearXNG +> API**: it publishes container port 8085, which is Marreta's nginx (moved off 8080 because +> SearXNG owns it in that namespace). Both ports show up against four container names because +> `searxng`, `searxng-valkey`, `gluetun` and the `marreta` pair share one network namespace. +> The pi-era [Pi Web Access](../pi/packages/pi-web-access.md) called the same host. -## Live instance (probed 2026-10-19) +## Live instance (probed 2026-10-21) User Quadlet stack on dankclaw: `searxng.container` (`ghcr.io/searxng/searxng:latest`) + `searxng-valkey.container` -(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the -containers share its network namespace, which is why `podman ps` shows :8081/ -:8082 on several names) + `marreta`/`marreta_browser`. `limiter.toml`: enabled, -`pass_searxng_org: true`. +(`docker.io/valkey/valkey:9-alpine`) + `gluetun.container` (VPN egress; the other containers +join its network namespace, hence the shared port list) + `marreta`/`marreta_browser`. +`limiter.toml`: enabled, `pass_searxng_org: true`. -**Policy drift flag:** this page's tuned engine policy (google and bing -disabled; DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on -2026-08-16) is NOT live: `/config` on 2026-10-19 reports all 262 engines -enabled, google and bing included. Either the settings override was lost in -the 2026-10 stack reinstatement or the policy was deliberately dropped. -Confirm with Frank before re-applying. +**Policy drift flag:** this page's tuned engine policy (google and bing disabled; +DuckDuckGo/Wikipedia/Google News enabled — verified via `/config` on 2026-08-16) is NOT live. +`/config` re-read 2026-10-21: 262 engines, **zero disabled**, google and bing included — +unchanged since 2026-10-19. Either the override was lost in the 2026-10 stack reinstatement or +the policy was deliberately dropped. Confirm with Frank before re-applying. ## Plan the Deployment diff --git a/omp-docs/agentic-web-research/vpn-routing.md b/omp-docs/agentic-web-research/vpn-routing.md index 78313bb..735ae13 100644 --- a/omp-docs/agentic-web-research/vpn-routing.md +++ b/omp-docs/agentic-web-research/vpn-routing.md @@ -8,7 +8,7 @@ tags: - networking - proxy - unverified -verified: 2026-08-28 +verified: 2026-10-21 timestamp: 2026-08-19 resource: https://docs.searxng.org/admin/settings/settings_outgoing.html --- @@ -19,7 +19,10 @@ SearXNG talks to many upstream engines. Some of them rate-limit or block the sou This page gives four working patterns. Choose the one that matches how you run SearXNG. -> **Your setup:** SearXNG runs on another host at `192.168.0.143:8081` (dankclaw). Apply the Docker patterns on that host. The proxy pattern works from any host. +> **Fleet instance:** SearXNG runs on dankclaw (`192.168.0.143:8081`, HTML and JSON alike) +> inside gluetun's network namespace — Pattern 2 below, in Quadlet rather than Compose. The +> live shape is in [Fleet instance on dankclaw](#fleet-instance-on-dankclaw), read 2026-10-21. +> The proxy pattern (1) works from any host. ## The Goal @@ -156,11 +159,33 @@ This pattern places the whole SearXNG process inside the tunnel namespace. The h | Dedicated network | Medium | High | No | | Inside VPN container | Medium | Highest | No | +## Fleet instance on dankclaw + +Read from the running container 2026-10-21 (`podman inspect gluetun`, `podman ps`): + +* **`VPN_SERVICE_PROVIDER=custom` with `VPN_TYPE=wireguard`.** The provider is Proton VPN, + configured as *manual* WireGuard: the single-peer `WIREGUARD_*` names + (`WIREGUARD_PRIVATE_KEY`, `WIREGUARD_PEER_PUBLIC_KEY`, `WIREGUARD_ENDPOINT_IP`) are what + gluetun reads. `VPN_SERVICE_PROVIDER=protonvpn` is wrong here, and so is the plural + `WIREGUARD_PEERS_*` family — that shape belongs to a different gluetun major. +* **One namespace, four names.** `searxng`, `searxng-valkey`, `marreta` and `marreta_browser` + join gluetun's network namespace, so `podman ps` prints the same published-port list against + all of them: `8081→8080` is SearXNG, `8082→8085` is Marreta's nginx, which moved off 8080 + because SearXNG owns it inside that namespace. +* **`FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT=on`.** The name is the warning: + turning it off sends the container's egress out the plain internet while every "VPN is + configured" check keeps passing — results then quietly come from the host IP. +* **Health:** tunnel presence is `podman exec gluetun sh -c 'test -e /sys/class/net/tun0'` + (true on this box). gluetun ships no curl, so an egress-IP check needs a companion container + on its network — see [Verify the Route](#verify-the-route). + ## Decisions That Matter - A SOCKS proxy keeps the per-engine control. Use Pattern 1. - Gluetun gives the cleanest full-tunnel setup. Use Pattern 2. -- Mullvad ships its own WireGuard keys for Gluetun. +* Copying an upstream example? Read the provider and env shape from + [Fleet instance on dankclaw](#fleet-instance-on-dankclaw) first: the mullvad-shaped block in + Pattern 2 is an illustration, not this fleet's config. - An OpenVPN-only provider works with Pattern 3 or 4. ## Verify the Route