dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

open-webui: make the SearXNG web-search wiring git-managed

Browse Source 
The per-key config DB already pointed web search at SearXNG (engine=searxng,
query URL http://192.168.0.143:8081/search), but only inside the data volume.
The quadlet now carries the same values as seeding env vars, so a fresh data
dir comes up wired, and the doc records the access path: the internal
host-published port, not the search. vhost — the Anubis->Authentik guard
chain is browser-only, and the bridge egress sits in SearXNG's pass_ip, so
the 4-req/IP/hour JSON cap never applies.
This commit is contained in:
Frank
2026-09-21 15:22:49 -07:00
parent 9e0c918b6e
commit d63acd489c
2 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/open-webui/quadlet/open-webui.container
+14
View File
@@ -32,6 +32,20 @@ PublishPort=3005:8080
Environment=OPENAI_API_BASE_URL=http://192.168.0.143:7770
Environment=ANONYMIZED_TELEMETRY=False
Environment=DO_NOT_TRACK=True
# Web search -> SearXNG, reached over the host-published port (NOT the
# search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a
# browser mechanism and a plain HTTP client cannot solve it. The internal
# port bypasses Caddy entirely. These env vars SEED the per-key config DB on
# first run (fill-missing only); once the keys exist in /app/backend/data the
# DB is authoritative, so this block documents the intent and makes a fresh
# data dir come up wired. SearXNG's limiter exempts this source (the bridge
# egress 10.89.x is in pass_ip), so the 4-req/IP/hour JSON cap never applies.
Environment=ENABLE_WEB_SEARCH=True
Environment=WEB_SEARCH_ENGINE=searxng
Environment=SEARXNG_QUERY_URL=http://192.168.0.143:8081/search
Environment=SEARXNG_LANGUAGE=all
Environment=WEB_SEARCH_RESULT_COUNT=6
Volume=/home/dank/Containers/open-webui/data:/app/backend/data
# App liveness (/health) AND network liveness (a non-loopback interface must
serverAppConfigs-docs/Dankclaw/OpenWebUI.md
+20
View File
@@ -39,6 +39,26 @@ OpenAI connection at `http://192.168.0.235:7770/v1` (key `none`).
sizing, and spec tuning happen there. See the [LLM knowledge
base](../LLM/index.md).
## Web search
Chat web search is served by [[SearXNG]] on this host, wired in the quadlet
(`ENABLE_WEB_SEARCH`, `WEB_SEARCH_ENGINE=searxng`, `SEARXNG_QUERY_URL`).
- **Access path:** the backend calls `http://192.168.0.143:8081/search?format=json`
directly — gluetun's published port, NOT the `search.franksdank.cloud` vhost.
The Anubis→Authentik guard chain is a browser mechanism (proof-of-work +
session flow); a plain HTTP client cannot solve it, and the internal port
bypasses Caddy entirely.
- **Limiter:** SearXNG caps non-HTML (JSON) requests at 4/IP/hour (`API_MAX`,
a hardcoded Python constant — no config knob). The `pass_ip` list is checked
FIRST and short-circuits the whole botdetection chain, and OpenWebUI's bridge
egress (`10.89.x`) is in `pass_ip`, so the cap never applies. Verified: an
8-request burst from the container returned 8×200.
- **Config storage:** OpenWebUI keeps web-search settings per-key in its SQLite
config table (`webui.db`, `web.search.*`). The quadlet env vars seed that
table on first start (fill-missing only); afterwards the DB is authoritative
and Admin-UI edits persist there.
## Boot persistence (Quadlet)
The unit lives at `dankclaw/open-webui/quadlet/open-webui.container`. On the host it installs to `~/.config/containers/systemd/open-webui.container`. The generator turns it into `open-webui.service`. Because the unit sets `[Install] WantedBy=default.target` and user linger is on, it starts at boot. `systemctl --user is-enabled open-webui.service` reports `generated` (the quadlet boot-start state).