searxng: init (also forgot to introduce forgejo oidc secret... oops)

modules/nixos/services/homeserver/default.nix

@@ -11,6 +11,7 @@
     ./kanidm.nix
     ./nextcloud.nix
     ./ntfy.nix
+    ./searxng.nix
     ./sops.nix
     ./technitium-dns.nix
     ./uptime-kuma.nix

modules/nixos/services/homeserver/searxng.nix

@@ -0,0 +1,107 @@
+{ config, ... }:
+
+{
+  sops.secrets."searxng/secrets.env" = {};
+
+  services.caddy.virtualHosts."searxng.taild5f7e6.ts.net".extraConfig =
+  assert config.services.caddy.enable;
+  ''
+    import default-settings
+
+    bind tailscale/searxng
+
+    reverse_proxy localhost:${toString config.services.searx.settings.server.port}
+  '';
+
+  services.searx = {
+    enable = true;
+    redisCreateLocally = true;
+    settings = {
+      general = {
+        instance_name = "Wo2wz's SearXNG";
+        enable_metrics = false;
+      };
+
+      server = {
+        bind_address = "127.0.0.1";
+        port = 8009;
+        base_url = "https://searxng.taild5f7e6.ts.net";
+        secret_key = "$SEARXNG_SECRET_KEY";
+      };
+
+      ui.default_locale = "en";
+
+      search = {
+        safe_search = 1;
+        default_lang = "en-US";
+        autocomplete = "duckduckgo";
+        favicon_resolver = "duckduckgo";
+      };
+
+      engines = [
+        # brave is broken from what it seems
+        {
+          name = "brave";
+          disabled = true;
+        }
+
+        {
+          name = "bing news";
+          disabled = true;
+        }
+        
+        {
+          name = "deezer";
+          disabled = false;
+        }
+
+        {
+          name = "annas archive";
+          disabled = false;
+        }
+        {
+          name = "piratebay";
+          disabled = true;
+        }
+
+        {
+          name = "nixos wiki";
+          disabled = false;
+        }
+        {
+          name = "codeberg";
+          disabled = false;
+        }
+
+        {
+          name = "docker hub";
+          disabled = true;
+        }
+        {
+          name = "hoogle";
+          disabled = true;
+        }
+        {
+          name = "pypi";
+          disabled = true;
+        }
+
+        {
+          name = "hackernews";
+          disabled = false;
+        }
+      ];
+    };
+    faviconsSettings.favicons = {
+      cfg_schema = 1;
+      cache = {
+        db_url = "/var/cache/searx/faviconcache.db";
+        HOLD_TIME = 5184000;
+        LIMIT_TOTAL_BYTES = 104857600;
+        BLOB_MAX_BYTES = 40960;
+        MAINTENANCE_MODE = "auto";
+        MAINTENANCE_PERIOD = 600;
+      };
+    };
+  };
+}