From ba0345ae7a6357278c9531cfccc28142e159355e Mon Sep 17 00:00:00 2001 From: Frank Date: Mon, 31 Aug 2026 06:49:35 -0700 Subject: [PATCH] docs(searxng): record verified agent-API contract under the Anubis guard MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified live 2026-08-31: guarded path serves the Anubis JS challenge at HTTP 200 to non-browser API clients (status-only consumers silently get HTML); direct published port 8081 from pass_ip sources returns real JSON. Decision: no second agent-only instance — same engines and same rate-sensitive VPN exit IP would see double request volume for zero gain. --- serverAppConfigs-docs/Dankclaw/SearXNG.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/serverAppConfigs-docs/Dankclaw/SearXNG.md b/serverAppConfigs-docs/Dankclaw/SearXNG.md index 808ac92..b9e52c0 100644 --- a/serverAppConfigs-docs/Dankclaw/SearXNG.md +++ b/serverAppConfigs-docs/Dankclaw/SearXNG.md @@ -138,7 +138,17 @@ root cause, the suspend-model table, the `engines:` config, and the ### Gotchas - The JSON API rate cap (4 per 3600s per IP) is hardcoded in Python, not settable in `limiter.toml`. The only bypass is `pass_ip`. Local subagents are covered because their slirp/loopback/LAN sources are in `pass_ip`. -- The limiter stays armed for untrusted sources (a spoofed public IP still 429s). Do not disable it. Widen only `pass_ip` for sources you trust on this host. +- **Agent-API contract (verified live 2026-08-31):** the guarded path + (`search.franksdank.cloud`) answers non-browser API clients with Anubis' + JS-challenge page at HTTP **200** — a status-code-only client silently gets + HTML where it expected JSON. Check `content-type`, not just status. There is + deliberately no way for an API client through the guard (JS challenge + UA + deny-list); the agent path is the direct published port + `http://192.168.0.143:8081/search?q=…&format=json` from trusted sources — + same instance, VPN-bound egress via Gluetun, unreachable from outside the + LAN by construction (no public route to the LAN IP). No second agent-only + instance is needed; a duplicate would double upstream request volume from the + same rate-sensitive VPN exit IP for zero benefit. - The config file is root-owned (uid of the rootless podman namespace). Update it with a one-off `sudo cp`, then run `systemctl --user restart searxng.service` to reload. - `base_url` must match the public address or proxy rewrites break. - Keep the valkey cache container on the same podman network as searxng.