Frank
6e9bfd5d3e
Converts the podman-compose SearXNG stack to boot-persistent quadlet units so
it survives a reboot (the compose deployment did not). searxng sets
Network=gluetun.container, which makes it reuse gluetun's network namespace so
outbound search traffic exits the WireGuard tunnel; it publishes no port of its
own (the port lives on gluetun). gluetun and valkey join a pinned searxng
network (10.89.2.0/24, DNS-enabled) so searxng reaches valkey by name.
Secrets stay in /opt/searxng/.env (mode 0600), referenced via [Service]
EnvironmentFile= so ${VAR} expands. Adds a bats seam asserting the netns
wiring, port placement, boot install, and that no secret material is tracked.
53 lines
1.7 KiB
TOML
53 lines
1.7 KiB
TOML
# SearXNG limiter / bot-detection config.
|
|
# Deployed to /opt/searxng/config/limiter.toml on Dankclaw (mounted at
|
|
# /etc/searxng/limiter.toml). Loaded when server.limiter: true in settings.yml.
|
|
#
|
|
# The "trusted group" lives HERE, not in settings.yml.
|
|
# Docs: https://docs.searxng.org/admin/searx.limiter.html
|
|
|
|
[botdetection]
|
|
|
|
# Number of leading bits compared to group addresses into a (client) network.
|
|
ipv4_prefix = 32
|
|
ipv6_prefix = 48
|
|
|
|
# If the request IP is in trusted_proxies, the real client IP is read from the
|
|
# X-Forwarded-For / X-Real-IP headers (set by the Caddy reverse proxy).
|
|
# SearXNG must be reached through Caddy (search.dankclaw.local): a direct hit on
|
|
# the published port has no X-Forwarded-For header, so the bot-detection cannot
|
|
# resolve a client and rate-limits it. Caddy connects from the podman bridge, so
|
|
# the bridge subnet must be trusted here. NOTE: rootless podman assigns the bridge
|
|
# CIDR dynamically; pin the network (podman network create with a fixed --subnet)
|
|
# so these entries stay stable.
|
|
trusted_proxies = [
|
|
'127.0.0.0/8',
|
|
'::1',
|
|
'192.168.0.0/24',
|
|
'10.88.0.0/24',
|
|
'10.89.1.0/24',
|
|
'10.89.2.0/24',
|
|
]
|
|
|
|
[botdetection.ip_limit]
|
|
|
|
# Link-local addresses (fe80::/10, 169.254.0.0/16) are not monitored.
|
|
filter_link_local = false
|
|
|
|
# link_token: per-session URL bypass token. Keep off.
|
|
link_token = false
|
|
|
|
[botdetection.ip_lists]
|
|
|
|
# ip_lists outranks every other method: an IP in pass_ip gets unrestricted
|
|
# access and is not checked by user-agent or other bot detection.
|
|
# The whole homelab LAN is trusted.
|
|
pass_ip = [
|
|
'192.168.0.0/24',
|
|
]
|
|
|
|
# Blocklist (none).
|
|
block_ip = []
|
|
|
|
# Keep the SearXNG org passlist (e.g. check.searx.space) enabled.
|
|
pass_searxng_org = true
|