modules.services.searx: init

devices/pc/default.nix

@@ -127,6 +127,7 @@ inputs:
         ananicy = {};
         keyd = {};
         lumericalLicenseManager = {};
+        searx = {};
       };
       bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
       packages = { android-studio = {}; mathematica = {}; };

devices/pc/secrets/default.yaml

@@ -18,6 +18,8 @@ nix:
     remote: ENC[AES256_GCM,data:uosYkxTCB0wiY+Uufk//OcBZFN3EzbZoQGZ95M9eZMjQ5AobAZqosi4laE+EMcZL1CqYqlWXaSoEUOB8biUaZPseo+1AX1TlmUgZ7QpkfOX0VKZu01C6C+lVyqVqMFq6z1BFyX/oeITMIfnd4a/2KwJCHLAZ4hMkJ5p+aJwByKGa3N/2m41HH/1S3z7pYQWj7YJxunTPPG6WNSiRncQki11rvmddwnXmsBF89+jW1Phge8U295haC57T5oIGPxR645IeTK4ZUlL8eVuZ+BhsnwbkYcaxvjSwe+DOIVPupR8GW+gis7KxwE89kqvnQhinamexcPUz4lGHlqO/Xn6jrJx6T/wXF+19epAzeHapYte3dTWNsdPwPLPJihT16YT5fwrLnH3zq8kexWz1crmnCGUoaBs4S2tHWHLgv2lTv0IHLx5F6ijpDBj/Avg9YILIURzdeea+rBxdycHasUDTVlJtYKRH5J+WbAKWI+oJ5qmXjIRUYL+O9xIUfOGO+1b3xs8MYxRWuvDV2P88N8vN,iv:yQQp5wjbSVn1oia5yL7d6GF9Vo704G0iOQRGMbzQHzg=,tag:bpBag5y5n+7ojOa8QOcDvA==,type:str]
 wechat2tg:
     token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
+searx:
+    secret-key: ENC[AES256_GCM,data:KhIP+Rz3rMfNgPEGTlKGvm6gl1/ZuPI=,iv:GcaLEJHKJO3n6IaeiFr9PaJ6eNx04/VjX3UgmBF429g=,tag:HkplyH9hTHUaEZ709TyitA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -42,8 +44,8 @@ sops:
             OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
             +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-10T10:44:16Z"
-    mac: ENC[AES256_GCM,data:slqGKfjbaYWg4VgLGUEbzLhF2KB6m6BfxDfZHu1dOxHzWjutkO+cZHjmNokgMH24l5PoTckbo89pLGRoG71Wd2J/JVsDN6Ic+SoYafe9xrIS4NFMC+x6ldmwWCZ+7F0D+ng8Yb/yY3owC1xmHB4WSghlo9P3pm0hgTcUKPKIWIo=,iv:aMkH+7YmReDP0QPR74bvS7++oo6AJV2UGWMB1K7Wf9s=,tag:VeIW+tsifAx3dlxvTdMWcw==,type:str]
+    lastmodified: "2025-04-13T05:59:15Z"
+    mac: ENC[AES256_GCM,data:/m/cioV71s7HJ7ObIDCr69wDLn2xk/lTRqmUCx46u7tzOwMsYqU6DghBsZuaUN1r22CbMi1wtmSziDisKStOGY27pswNe7IuEo4IhVz5sJNxcWCxpYo8ttrCUeaJ7Y0vFbseIn1l1UObfubhhvVdxDsE0RoxLK7Ka8hJW5aEksM=,iv:GKmlbRXFexMegBWBVx4vusA0ceZZnwGIN2FkSpGXMdY=,tag:yoCnH94Ph0AUjkN3CTg6wA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.2

flake/dns/config/chn.moe.nix

@@ -26,6 +26,7 @@ let
     srv1 = "59.77.36.250";
     vps6 = "144.34.225.59";
     vps7 = "144.126.144.62";
+    search = "127.0.0.1";
   };
   wireguard =
   {

modules/services/searx.nix

@@ -0,0 +1,30 @@
+inputs:
+{
+  options.nixos.services.searx = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule { options =
+    {
+      hostname = mkOption { type = types.nonEmptyStr; default = "search.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) searx; in inputs.lib.mkIf (searx != null)
+  {
+    services.searx =
+    {
+      enable = true;
+      settings.server = { port = 8081; bind_address = "127.0.0.1"; secret_key = "@SEARX_SECRET_KEY@"; };
+      environmentFile = inputs.config.sops.templates."searx.env".path;
+    };
+    sops =
+    {
+      templates."searx.env".content = let inherit (inputs.config.sops) placeholder; in
+      ''
+        SEARX_SECRET_KEY=${placeholder."searx/secret-key"}
+      '';
+      secrets."searx/secret-key" = {};
+    };
+    nixos.services.nginx =
+      { enable = true; https.${searx.hostname}.location."/".proxy.upstream = "http://127.0.0.1:8081"; };
+  };
+}