Add searxng module

modules/default.nix

@@ -7,5 +7,6 @@
     ./social
     ./file-server
     ./samba
+    ./searxng
   ];
 }

modules/reverse-proxy/traefik/default.nix

@@ -53,10 +53,10 @@ in {
             acme = {
               email = "susano@local.com";
               storage = "/var/lib/traefik/acme.json"; # Where Traefik stores certs
-              # Use the DNS-01 challenge with the DuckDNS provider
+
               dnsChallenge = {
                 provider = "duckdns";
-                disablePropagationCheck = true;
+                #disablePropagationCheck = true;
               };
             };
           };
@@ -91,6 +91,13 @@ in {
               service = "copyparty-service";
               tls.certResolver = "duckdns";
             };
+
+            searxng = mkIf config.dov.searxng.enable {
+              rule = "Host(`searxng.${domain}`)";
+              entryPoints = [ "websecure" ];
+              service = "serxng-service";
+              tls.certResolver = "duckdns";
+            };
           };
 
           services = {
@@ -104,7 +111,14 @@ in {
             copyparty-service = mkIf config.dov.file-server.copyparty.enable {
               loadBalancer.servers = [
                 # The backend URL for Immich
-                { url = "http://192.168.1.85:3923"; }
+                { url = "http://susano:3923"; }
+              ];
+            };
+
+            serxng-service = mkIf config.dov.searxng.enable {
+              loadBalancer.servers = [
+                # The backend URL for Immich
+                { url = "http://susano:8888"; }
               ];
             };
           };

modules/searxng/default.nix

@@ -0,0 +1,181 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.dov.searxng;
+  port = 8888;
+in {
+  options.dov.searxng = {
+    enable = mkEnableOption "searxng config";
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [ port ];
+
+    sops.secrets.searxng = { };
+
+    services.searx = {
+      enable = cfg.enable;
+      redisCreateLocally = true;
+
+      # Rate limiting
+      limiterSettings = {
+        real_ip = {
+          x_for = 1;
+          ipv4_prefix = 32;
+          ipv6_prefix = 56;
+        };
+
+        botdetection = {
+          ip_limit = {
+            filter_link_local = true;
+            link_token = true;
+          };
+        };
+      };
+
+      # UWSGI configuration
+      runInUwsgi = true;
+
+      uwsgiConfig = {
+        socket = "/run/searx/searx.sock";
+        http = ":${ builtins.toString port}";
+        chmod-socket = "660";
+      };
+
+      # Searx configuration
+      settings = {
+        # Instance settings
+        general = {
+          debug = false;
+          instance_name = "NixOS SearXNG";
+          donation_url = false;
+          contact_url = false;
+          privacypolicy_url = false;
+          enable_metrics = false;
+        };
+
+        # User interface
+        ui = {
+          static_use_hash = true;
+          default_locale = "en";
+          query_in_title = true;
+          infinite_scroll = false;
+          center_alignment = true;
+          default_theme = "simple";
+          theme_args.simple_style = "auto";
+          search_on_category_select = false;
+          hotkeys = "vim";
+        };
+
+        # Search engine settings
+        search = {
+          safe_search = 2;
+          autocomplete_min = 2;
+          autocomplete = "duckduckgo";
+          ban_time_on_fail = 5;
+          max_ban_time_on_fail = 120;
+        };
+
+        # Server configuration
+        server = {
+          base_url = "https://searng.susano-nixos.duckdns.org";
+          port = port;
+          bind_address = "127.0.0.1";
+          secret_key = config.sops.secrets.searxng.path;
+          limiter = true;
+          public_instance = true;
+          image_proxy = true;
+          method = "GET";
+        };
+
+        # Search engines
+        engines = lib.mapAttrsToList (name: value: { inherit name; } // value) {
+          "duckduckgo".disabled = true;
+          "brave".disabled = true;
+          "bing".disabled = false;
+          "mojeek".disabled = true;
+          "mwmbl".disabled = false;
+          "mwmbl".weight = 0.4;
+          "qwant".disabled = true;
+          "crowdview".disabled = false;
+          "crowdview".weight = 0.5;
+          "curlie".disabled = true;
+          "ddg definitions".disabled = false;
+          "ddg definitions".weight = 2;
+          "wikibooks".disabled = false;
+          "wikidata".disabled = false;
+          "wikiquote".disabled = true;
+          "wikisource".disabled = true;
+          "wikispecies".disabled = false;
+          "wikispecies".weight = 0.5;
+          "wikiversity".disabled = false;
+          "wikiversity".weight = 0.5;
+          "wikivoyage".disabled = false;
+          "wikivoyage".weight = 0.5;
+          "currency".disabled = true;
+          "dictzone".disabled = true;
+          "lingva".disabled = true;
+          "bing images".disabled = false;
+          "brave.images".disabled = true;
+          "duckduckgo images".disabled = true;
+          "google images".disabled = false;
+          "qwant images".disabled = true;
+          "1x".disabled = true;
+          "artic".disabled = false;
+          "deviantart".disabled = false;
+          "flickr".disabled = true;
+          "imgur".disabled = false;
+          "library of congress".disabled = false;
+          "material icons".disabled = true;
+          "material icons".weight = 0.2;
+          "openverse".disabled = false;
+          "pinterest".disabled = true;
+          "svgrepo".disabled = false;
+          "unsplash".disabled = false;
+          "wallhaven".disabled = false;
+          "wikicommons.images".disabled = false;
+          "yacy images".disabled = true;
+          "bing videos".disabled = false;
+          "brave.videos".disabled = true;
+          "duckduckgo videos".disabled = true;
+          "google videos".disabled = false;
+          "qwant videos".disabled = false;
+          "dailymotion".disabled = true;
+          "google play movies".disabled = true;
+          "invidious".disabled = true;
+          "odysee".disabled = true;
+          "peertube".disabled = false;
+          "piped".disabled = true;
+          "rumble".disabled = false;
+          "sepiasearch".disabled = false;
+          "vimeo".disabled = true;
+          "youtube".disabled = false;
+          "brave.news".disabled = true;
+          "google news".disabled = true;
+        };
+
+        # Outgoing requests
+        outgoing = {
+          request_timeout = 5.0;
+          max_request_timeout = 15.0;
+          pool_connections = 100;
+          pool_maxsize = 15;
+          enable_http2 = true;
+        };
+
+        # Enabled plugins
+        enabled_plugins = [
+          "Basic Calculator"
+          "Hash plugin"
+          "Tor check plugin"
+          "Open Access DOI rewrite"
+          "Hostnames plugin"
+          "Unit converter plugin"
+          "Tracker URL remover"
+        ];
+      };
+    };
+  };
+}