From 14460d387b2403484cb9ae1b272feb447e8efe2c Mon Sep 17 00:00:00 2001 From: Effi Server Date: Mon, 20 Jul 2026 15:41:44 +0000 Subject: [PATCH] feat: deploy SearXNG search engine with Valkey rate limiting - Add SearXNG service on port 6060 (replaces old port 11112) - Add Valkey for rate limiting (5/min, 60/hour, 500/day) - Add Nginx reverse proxy with X-Real-IP and X-Forwarded-For headers - Configure JSON format and French locale - Add rate limiting configuration in limiter.toml - Add Valkey configuration in valkey.conf --- docker-compose.yml | 35 ++++++++++++++++++--- proxy-config/nginx.conf | 22 +++++++++++++ searxng-config/limiter.toml | 50 ++++++++++++++++++++++++++++++ searxng-config/settings.yml | 61 +++++++++++++++++++++++++++++++++++++ searxng-config/valkey.conf | 26 ++++++++++++++++ 5 files changed, 189 insertions(+), 5 deletions(-) create mode 100644 proxy-config/nginx.conf create mode 100644 searxng-config/limiter.toml create mode 100644 searxng-config/settings.yml create mode 100644 searxng-config/valkey.conf diff --git a/docker-compose.yml b/docker-compose.yml index 52a9ea3..2d70b4d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,20 +6,44 @@ services: # ───────────────────────────────────────────────────────── - # 0. SEARXNG - Meta-search Engine (Web Search) - # → http://192.168.1.27:11112 + # 0. VALKEY - Backend de rate limiting pour SearXNG + # → Port interne uniquement (non exposé) + # ───────────────────────────────────────────────────────── + valkey: + image: valkey/valkey:7-alpine + container_name: effi-valkey + restart: unless-stopped + command: valkey-server /usr/local/etc/valkey/valkey.conf + volumes: + - ./searxng-config/valkey.conf:/usr/local/etc/valkey/valkey.conf:ro + - valkey-data:/data/valkey-data + networks: + - effi-net + + # ───────────────────────────────────────────────────────── + # 1. SEARXNG - Meta-search Engine (API JSON) + # → http://192.168.1.27:6060 # ───────────────────────────────────────────────────────── searxng: image: searxng/searxng:latest container_name: effi-searxng restart: unless-stopped ports: - - "11112:8080" + - "6060:8080" volumes: - - ./searxng-data:/etc/searxng:rw + - ./searxng-config/settings.yml:/etc/searxng/settings.yml:ro environment: - - SEARXNG_BASE_URL=http://192.168.1.27:11112/ + - SEARXNG_BASE_URL=http://192.168.1.27:6060/ - SEARXNG_SECRET=${SEARXNG_SECRET_KEY} + - SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8080/healthz"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 30s + depends_on: + - valkey networks: - effi-net @@ -265,3 +289,4 @@ volumes: open-webui-data: pipelines-data: whisper-cache: + redis-data: diff --git a/proxy-config/nginx.conf b/proxy-config/nginx.conf new file mode 100644 index 0000000..5a0d981 --- /dev/null +++ b/proxy-config/nginx.conf @@ -0,0 +1,22 @@ +events { + worker_connections 1024; +} + +http { + upstream searxng { + server effi-searxng:8080; + } + + server { + listen 6060; + server_name localhost; + + location / { + proxy_pass http://searxng; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + } +} diff --git a/searxng-config/limiter.toml b/searxng-config/limiter.toml new file mode 100644 index 0000000..b29050e --- /dev/null +++ b/searxng-config/limiter.toml @@ -0,0 +1,50 @@ +[botdetection] + +# The prefix defines the number of leading bits in an address that are compared +# to determine whether or not an address is part of a (client) network. + +ipv4_prefix = 32 +ipv6_prefix = 48 + +# If the request IP is in trusted_proxies list, the client IP address is +# extracted from the X-Forwarded-For and X-Real-IP headers. This should be +# used if SearXNG is behind a reverse proxy or load balancer. + +trusted_proxies = [ + '127.0.0.0/8', + '::1', + '172.19.0.0/16', + # '192.168.0.0/16', + # '172.16.0.0/12', + # '10.0.0.0/8', + # 'fd00::/8', +] + +[botdetection.ip_limit] + +# To get unlimited access in a local network, by default link-local addresses +# (networks) are not monitored by the ip_limit +filter_link_local = false + +# activate link_token method in the ip_limit method +link_token = false + +[botdetection.ip_lists] + +# In the limiter, the ip_lists method has priority over all other methods -> if +# an IP is in the pass_ip list, it has unrestricted access and it is also not +# checked if e.g. the "user agent" suggests a bot (e.g. curl). + +block_ip = [ + # '93.184.216.34', # IPv4 of example.org + # '257.1.1.1', # invalid IP --> will be ignored, logged in ERROR class +] + +pass_ip = [ + # '192.168.0.0/16', # IPv4 private network + # 'fe80::/10' # IPv6 linklocal / wins over botdetection.ip_limit.filter_link_local +] + +# Activate passlist of (hardcoded) IPs from the SearXNG organization, +# e.g. `check.searx.space`. +pass_searxng_org = true diff --git a/searxng-config/settings.yml b/searxng-config/settings.yml new file mode 100644 index 0000000..c7294f7 --- /dev/null +++ b/searxng-config/settings.yml @@ -0,0 +1,61 @@ +use_default_settings: true + +general: + instance_name: "Effi Search" + debug: false + +search: + format: json + max_results: 15 + default_lang: fr + safe_search: 0 + autocomplete: "google" + default_locale: fr + formats: + - html + - json + +server: + secret_key: "${SEARXNG_SECRET_KEY}" + bind_address: "0.0.0.0" + port: 8080 + limiter: true + image_proxy: true + public_instance: false + method: "GET" + default_http_headers: + X-Content-Type-Options: nosniff + X-Download-Options: noopen + X-Robots-Tag: noindex, nofollow + Referrer-Policy: no-referrer + +valkey: + url: "valkey://172.19.0.12:6379/0" + +limiter: + enabled: true + search_url: false + key: + - "client_ip" + limits: + search: "5/minute;60/hour;500/day" + other: "10/minute;100/hour" + whitelist: [] + +ui: + default_theme: simple + static_use_hash: true + default_view: index + infinite_scroll: false + +outgoing: + request_timeout: 10.0 + max_request_timeout: 15.0 + pool_connections: 100 + pool_maxsize: 20 + enable_http2: true + useragent_suffix: "" + +enable_obfuscation: false + +enable_http2: true diff --git a/searxng-config/valkey.conf b/searxng-config/valkey.conf new file mode 100644 index 0000000..9aa9fb6 --- /dev/null +++ b/searxng-config/valkey.conf @@ -0,0 +1,26 @@ +# Redis configuration for SearXNG rate limiting +bind 0.0.0.0 +protected-mode no +port 6379 +tcp-backlog 511 +timeout 0 +tcp-keepalive 300 +daemonize no +supervised no +pidfile /var/run/redis_6379.pid +loglevel notice +databases 1 +save 900 1 +save 300 10 +save 60 10000 +stop-writes-on-bgsave-error yes +rdbcompression yes +rdbchecksum yes +dbfilename dump.rdb +dir /data +appendonly no +appendfilename "appendonly.aof" +hz 10 +dynamic-hz yes +aof-rewrite-incremental-fsync yes +rdb-save-incremental-fsync yes