From c390135d56aebef4bbe66322c768d75167cb7395 Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 18 Aug 2026 17:52:44 -0700 Subject: [PATCH] SearXNG: trusted group needs Caddy XFF; trust the podman bridge A direct hit on the published port has no X-Forwarded-For header, so the bot-detection cannot resolve a client and returns 429. SearXNG must be reached through Caddy (search.dankclaw.local), which sets X-Forwarded-For. Add the podman bridge subnets to trusted_proxies so Caddy's source is trusted for XFF extraction; note the CIDR is dynamic and should be pinned. Verified agentic JSON search returns 26-31 relevant results via this path. --- docs/Dankclaw/SearXNG.md | 3 +++ shared/searxng/limiter.toml | 8 ++++++++ 2 files changed, 11 insertions(+) diff --git a/docs/Dankclaw/SearXNG.md b/docs/Dankclaw/SearXNG.md index 9d0cc30..a463a7b 100644 --- a/docs/Dankclaw/SearXNG.md +++ b/docs/Dankclaw/SearXNG.md @@ -75,9 +75,12 @@ Two lists control access: The whole homelab LAN `192.168.0.0/24` is in both lists. This lets local agents and browsers poll the JSON API without tripping the 4-per-hour limit. `deploy.sh` copies the file into place on each deploy. +Access SearXNG through Caddy (`search.dankclaw.local`). A direct request on the published port has no `X-Forwarded-For` header. The bot-detection cannot resolve the client and returns 429. The podman bridge subnet is in `trusted_proxies` so Caddy's request is trusted. The bridge CIDR is assigned dynamically by rootless podman. Pin the network (`podman network create` with a fixed `--subnet`) for a stable value. + ## Gotchas - The JSON API is rate-limited hard by the limiter (4 per 3600s per IP for untrusted). Add the agent's IP to `pass_ip` in `limiter.toml` if it polls. +- Reach SearXNG through Caddy, not the raw published port. A direct port hit has no `X-Forwarded-For` header and the bot-detection returns 429. - `base_url` must match the public address or proxy rewrites break. - Keep the valkey cache container on the same podman network as searxng. diff --git a/shared/searxng/limiter.toml b/shared/searxng/limiter.toml index 61a37aa..1b8ad64 100644 --- a/shared/searxng/limiter.toml +++ b/shared/searxng/limiter.toml @@ -13,10 +13,18 @@ ipv6_prefix = 48 # If the request IP is in trusted_proxies, the real client IP is read from the # X-Forwarded-For / X-Real-IP headers (set by the Caddy reverse proxy). +# SearXNG must be reached through Caddy (search.dankclaw.local): a direct hit on +# the published port has no X-Forwarded-For header, so the bot-detection cannot +# resolve a client and rate-limits it. Caddy connects from the podman bridge, so +# the bridge subnet must be trusted here. NOTE: rootless podman assigns the bridge +# CIDR dynamically; pin the network (podman network create with a fixed --subnet) +# so these entries stay stable. trusted_proxies = [ '127.0.0.0/8', '::1', '192.168.0.0/24', + '10.88.0.0/24', + '10.89.1.0/24', ] [botdetection.ip_limit]