Quadlet units are generator-managed; systemctl enable fails on them
('transient or generated'). The [Install] WantedBy=default.target in each
.container file is itself the enablement (is-enabled reports 'generated'), and
with user linger on they start at boot. Drop the enable step; daemon-reload and
start are enough.
The quadlet .network unit is generator-managed and cannot be enabled; it is
pulled in automatically by the containers that set Wants=/After=searxng-network.
Enable only the three container units. The explicit start of the network is kept
(start works on generated units).
Remove gluetun/searxng/valkey from dankclaw/compose.yaml (they are now
quadlet units) so podman-compose up can no longer fight them for the netns and
port 8081. Add scripts/deploy-searxng-quadlet.sh: an idempotent installer that
copies the units to ~/.config/containers/systemd/, daemon-reloads, enables them
for boot, and starts them in dependency order. Safe to run on first migration
and on every later change.
The trusted group lives in limiter.toml, not settings.yml. Add
shared/searxng/limiter.toml trusting 192.168.0.0/24 in pass_ip and
trusted_proxies, copy it into /opt/searxng/config on deploy, and correct
the SearXNG doc. New test seam: tests/searxng_limiter.bats.
Frank