gerd: adds searx w/ authentication in front

machines/gerd.nix

@@ -21,6 +21,7 @@
     ./gerd/services/nextcloud.nix
     ./gerd/services/stalwart
     ./gerd/services/wger
+    ./gerd/services/searx.nix
 
     ./gerd/services/element.nix
     ./gerd/services/matrix-synapse.nix

machines/gerd/services/searx.nix

@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+
+let
+  svc_domain = "searx.${config.mine.shared.settings.domain}";
+  port = 7378;
+in {
+  services.searx = {
+    enable = true;
+    runInUwsgi = true;
+    redisCreateLocally = true;
+
+    environmentFile = config.age.secrets.searx-env.path;
+
+    uwsgiConfig.http = "127.0.0.1:${builtins.toString port}";
+    settings = {
+      general.debug = false;
+      server = {
+        base_url = "https://${svc_domain}";
+        secret_key = "@SECRET_KEY@";
+      };
+    };
+  };
+
+  # nginx
+  services.nginx.virtualHosts."${svc_domain}" = config.mine.shared.lib.authelia.mkProtectedWebsite {
+    forceSSL = true;
+    enableACME = true;
+    
+    locations."/" = config.mine.shared.lib.authelia.mkProtectedLocation {
+      proxyPass = "http://localhost:${builtins.toString port}";
+    };
+  };
+
+  # meta
+  mine.shared.meta.searx = {
+    name = "searX";
+    description = "We host our own searX, use it to search the web!";
+    url = "https://${svc_domain}";
+
+    package = let
+      pkg = config.services.searx.package;
+    in {
+      name = pkg.pname;
+      version = pkg.version;
+      meta = pkg.meta;
+    };
+  };
+}

secrets/default.nix

@@ -45,6 +45,9 @@
     # restic
     restic-env.file = ./restic/env.age;
     restic-pass.file = ./restic/pass.age;
+
+    # searx
+    searx-env.file = ./searx/env.age;
   };
 
   users.groups.secrets-lldap-bind-user-pass = {};

secrets/secrets.nix

@@ -55,4 +55,7 @@ in
   # restic
   "restic/env.age".publicKeys = defaultAccess;
   "restic/pass.age".publicKeys = defaultAccess;
+
+  # searx
+  "searx/env.age".publicKeys = defaultAccess;
 }