Frank
7a8d992fce
The stock SearXNG image ships a native kagi engine; enabling it needs an
API key that must never enter git, and SearXNG does not expand env vars
in settings.yml (the live secret_key literally was '${SEARXNG_SECRET}'
until now — the app tolerated the placeholder string silently).
- settings.yml: kagi engine enabled (weight 2, kg shortcut, paging off so
exactly one API credit per aggregated query, timeout 8.0 vs 5.0 scrapers
so a slow paid query is not a wasted credit); api_key stays ${KAGI_API_KEY}.
- new scripts/searxng-render-settings.py: deploy-time renderer, allowlisted
to KAGI_API_KEY/SEARXNG_SECRET/SEARXNG_BASE_URL, fails the deploy loudly
on an unresolvable placeholder, idempotent on redeploys.
- deploy-remote.sh copy_searxng_config runs the renderer against
/opt/searxng/.env after copying settings.yml into /opt/searxng/config.
- KAGI_API_KEY placeholder added to dankclaw/.env.example (real key staged
into the host-side /opt/searxng/.env, mode 600, out of band).
- bats: engine wiring, renderer substitution, loud-failure, deployer seam.
- docs: SearXNG.md Kagi section + renderer law; Providers.md carve-out on
the no-credentials policy (paid engine acceptable when bounded + ordered).
Verified live on dankclaw: direct API probe via the gluetun netns (200,
data.search[] shape), then an aggregated query returned 29/29 results
tagged kagi, zero unresponsive engines.
82 lines
3.6 KiB
Bash
82 lines
3.6 KiB
Bash
# Dankclaw stack secrets and configuration.
|
|
# Copy to .env and fill real values. Never commit real secrets.
|
|
|
|
# SearXNG
|
|
SEARXNG_SECRET=changeme
|
|
SEARXNG_BASE_URL=http://search.franksdank.cloud/
|
|
# Kagi search API key (https://help.kagi.com/kagi/api/). Powers the paid
|
|
# `kagi` engine in shared/searxng/settings.yml; deploy-remote.sh bakes it into
|
|
# the live settings.yml via scripts/searxng-render-settings.py. The quadlet
|
|
# does NOT pass it into the container environment.
|
|
KAGI_API_KEY=changeme
|
|
|
|
# Gluetun VPN (see https://github.com/qdm12/gluetun-wiki)
|
|
# Single-peer WireGuard model. Fill from your provider's WireGuard config.
|
|
VPN_SERVICE_PROVIDER=protonvpn
|
|
VPN_TYPE=wireguard
|
|
WIREGUARD_PRIVATE_KEY=changeme
|
|
WIREGUARD_ADDRESSES=0.0.0.0/32
|
|
WIREGUARD_PUBLIC_KEY=changeme
|
|
WIREGUARD_ENDPOINT_IP=0.0.0.0
|
|
WIREGUARD_ENDPOINT_PORT=51820
|
|
WIREGUARD_ALLOWED_IPS=0.0.0.0/0,::/0
|
|
WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=25s
|
|
|
|
# Gitea database
|
|
GITEA_DB_PASSWORD=changeme
|
|
|
|
# Grafana OAuth2 client secret (authentik OAuth2Provider "grafana", pk 9).
|
|
# Created via ak shell on authentik-server; the live .env must hold the
|
|
# provider's generated client_secret verbatim. Rotation = rotate the provider
|
|
# secret in authentik, restart grafana after updating the live .env value.
|
|
GRAFANA_OAUTH_CLIENT_SECRET=changeme
|
|
|
|
# Caddy (the homelab's single reverse proxy, on this host)
|
|
# bcrypt hash (caddy hash-password). deploy.sh renders it into
|
|
# /home/dank/Containers/caddy/Caddyfile, which the container mounts.
|
|
# CADDY_BASICAUTH_HASH: the shared family password, now used only by the
|
|
# pihole vhost (grafana moved behind the Authentik guard chain 2026-09-01).
|
|
# Username: dankuser.
|
|
CADDY_BASICAUTH_HASH=changeme
|
|
# (The homepage's per-user hashes were retired: the homepage and its /admin/
|
|
# page are now behind Authentik forward_auth, not basicauth.)
|
|
|
|
# Hermes -> Signal (signal-cli daemon on the host, port 8080)
|
|
# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
|
|
SIGNAL_ACCOUNT=+15551234567
|
|
# Comma-separated E.164 numbers allowed to message the agent.
|
|
SIGNAL_ALLOWED_USERS=+15551234567
|
|
|
|
# Hermes web UI (Hermex server) login password. Required: the webui binds to
|
|
# loopback and is reached only through the SSH tunnel, but Hermex still signs
|
|
# in with this password. Set a strong value in the live .env.
|
|
HERMES_WEBUI_PASSWORD=changeme
|
|
|
|
# Porkbun API (franksdank.cloud + franksdank.casa zones). Caddy uses these
|
|
# for DNS-01 Let's Encrypt wildcard cert issuance. Porkbun API keys are
|
|
# account-wide; rotate them here rather than in the dashboard.
|
|
# PORKBUN_API_SECRET_KEY is the name the caddy-dns/porkbun module expects.
|
|
PORKBUN_API_KEY=changeme
|
|
PORKBUN_API_SECRET_KEY=changeme
|
|
|
|
# Authentik (SSO / OIDC provider)
|
|
# AUTHENTIK_PG_PASS: the PostgreSQL password for authentik-postgres.
|
|
# Generate: openssl rand -base64 32
|
|
AUTHENTIK_PG_PASS=changeme
|
|
# AUTHENTIK_SECRET_KEY: the server's secret key (64+ chars).
|
|
# Generate: openssl rand -base64 48
|
|
AUTHENTIK_SECRET_KEY=changeme
|
|
|
|
# Marreta (content-cleaning proxy, behind the Authentik guard chain).
|
|
# deploy-remote.sh seeds /home/dank/Containers/marreta/env from these three
|
|
# values (only if that file does not already exist) and the marreta quadlet
|
|
# maps them to the app's APP_KEY / ADMIN_EMAIL / ADMIN_PASSWORD.
|
|
# MARRETA_APP_KEY: Laravel encryption key. Generate:
|
|
# openssl rand -base64 32
|
|
# Changing it after first boot invalidates encrypted session/cookie data.
|
|
MARRETA_APP_KEY=changeme
|
|
# Admin panel login (marreta.franksdank.cloud/admin). The app creates this
|
|
# account on first boot from these values.
|
|
MARRETA_ADMIN_EMAIL=admin@franksdank.cloud
|
|
MARRETA_ADMIN_PASSWORD=changeme
|