# Quadlet unit: SearXNG search engine (rootless, boot-persistent).
#
# Install path on dankclaw: ~/.config/containers/systemd/searxng.container
# Unit name: searxng.service (container name: searxng)
#
# Reuses gluetun's network namespace (Network=gluetun.container) so its
# outbound traffic exits the WireGuard tunnel. It publishes no port of its own;
# the port lives on gluetun. It reaches valkey by name on the searxng network.
# Config mounts from /opt/searxng/config. See docs/Dankclaw/SearXNG.md.

[Unit]
Description=SearXNG search engine container
Wants=gluetun.service searxng-valkey.service
After=gluetun.service searxng-valkey.service network.target

[Container]
ContainerName=searxng
Network=gluetun.container
Image=ghcr.io/searxng/searxng:latest
Environment=SEARXNG_SECRET=${SEARXNG_SECRET}
Environment=SEARXNG_BASE_URL=${SEARXNG_BASE_URL}
Volume=/opt/searxng/config:/etc/searxng

[Service]
EnvironmentFile=/opt/searxng/.env
TimeoutStartSec=900
Restart=always

[Install]
WantedBy=default.target