dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

SearXNG: trusted group needs Caddy XFF; trust the podman bridge

Browse Source 
A direct hit on the published port has no X-Forwarded-For header, so the
bot-detection cannot resolve a client and returns 429. SearXNG must be
reached through Caddy (search.dankclaw.local), which sets X-Forwarded-For.
Add the podman bridge subnets to trusted_proxies so Caddy's source is
trusted for XFF extraction; note the CIDR is dynamic and should be pinned.
Verified agentic JSON search returns 26-31 relevant results via this path.
This commit is contained in:
Frank
2026-08-18 17:52:44 -07:00
parent 9ca22d1c34
commit c390135d56
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Dankclaw/SearXNG.md
+3
View File
@@ -75,9 +75,12 @@ Two lists control access:
The whole homelab LAN `192.168.0.0/24` is in both lists. This lets local agents and browsers poll the JSON API without tripping the 4-per-hour limit. `deploy.sh` copies the file into place on each deploy.
Access SearXNG through Caddy (`search.dankclaw.local`). A direct request on the published port has no `X-Forwarded-For` header. The bot-detection cannot resolve the client and returns 429. The podman bridge subnet is in `trusted_proxies` so Caddy's request is trusted. The bridge CIDR is assigned dynamically by rootless podman. Pin the network (`podman network create` with a fixed `--subnet`) for a stable value.
## Gotchas
- The JSON API is rate-limited hard by the limiter (4 per 3600s per IP for untrusted). Add the agent's IP to `pass_ip` in `limiter.toml` if it polls.
- Reach SearXNG through Caddy, not the raw published port. A direct port hit has no `X-Forwarded-For` header and the bot-detection returns 429.
- `base_url` must match the public address or proxy rewrites break.
- Keep the valkey cache container on the same podman network as searxng.
shared/searxng/limiter.toml
+8
View File
@@ -13,10 +13,18 @@ ipv6_prefix = 48
# If the request IP is in trusted_proxies, the real client IP is read from the
# X-Forwarded-For / X-Real-IP headers (set by the Caddy reverse proxy).
# SearXNG must be reached through Caddy (search.dankclaw.local): a direct hit on
# the published port has no X-Forwarded-For header, so the bot-detection cannot
# resolve a client and rate-limits it. Caddy connects from the podman bridge, so
# the bridge subnet must be trusted here. NOTE: rootless podman assigns the bridge
# CIDR dynamically; pin the network (podman network create with a fixed --subnet)
# so these entries stay stable.
trusted_proxies = [
'127.0.0.0/8',
'::1',
'192.168.0.0/24',
'10.88.0.0/24',
'10.89.1.0/24',
]
[botdetection.ip_limit]