open-webui: make the SearXNG web-search wiring git-managed

The per-key config DB already pointed web search at SearXNG (engine=searxng, query URL http://192.168.0.143:8081/search), but only inside the data volume. The quadlet now carries the same values as seeding env vars, so a fresh data dir comes up wired, and the doc records the access path: the internal host-published port, not the search. vhost — the Anubis->Authentik guard chain is browser-only, and the bridge egress sits in SearXNG's pass_ip, so the 4-req/IP/hour JSON cap never applies.
2026-09-21 15:22:49 -07:00
parent 9e0c918b6e
commit d63acd489c
2 changed files with 34 additions and 0 deletions
@@ -32,6 +32,20 @@ PublishPort=3005:8080
 Environment=OPENAI_API_BASE_URL=http://192.168.0.143:7770
 Environment=ANONYMIZED_TELEMETRY=False
 Environment=DO_NOT_TRACK=True
+
+# Web search -> SearXNG, reached over the host-published port (NOT the
+# search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a
+# browser mechanism and a plain HTTP client cannot solve it. The internal
+# port bypasses Caddy entirely. These env vars SEED the per-key config DB on
+# first run (fill-missing only); once the keys exist in /app/backend/data the
+# DB is authoritative, so this block documents the intent and makes a fresh
+# data dir come up wired. SearXNG's limiter exempts this source (the bridge
+# egress 10.89.x is in pass_ip), so the 4-req/IP/hour JSON cap never applies.
+Environment=ENABLE_WEB_SEARCH=True
+Environment=WEB_SEARCH_ENGINE=searxng
+Environment=SEARXNG_QUERY_URL=http://192.168.0.143:8081/search
+Environment=SEARXNG_LANGUAGE=all
+Environment=WEB_SEARCH_RESULT_COUNT=6
 Volume=/home/dank/Containers/open-webui/data:/app/backend/data

 # App liveness (/health) AND network liveness (a non-loopback interface must