kyle
94e85283c3
searx-init loads EnvironmentFile at spawn, so the secret must exist before systemd starts that unit. Drop the racing oneshot. Make tailscale-serve restart on NoState during switch.
64 lines
2.1 KiB
Nix
64 lines
2.1 KiB
Nix
{ pkgs, ... }:
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
# orion started as a desktop with an interactive installer;
|
|
# the disk is already provisioned.
|
|
# ./disk-config.nix
|
|
];
|
|
|
|
config = {
|
|
services.searx = {
|
|
enable = true;
|
|
redisCreateLocally = true;
|
|
environmentFile = "/var/lib/searx/secret.env";
|
|
settings = {
|
|
general.instance_name = "orion-search";
|
|
server = {
|
|
bind_address = "127.0.0.1";
|
|
port = 8888;
|
|
secret_key = "$SEARX_SECRET_KEY";
|
|
limiter = false;
|
|
public_instance = false;
|
|
image_proxy = false;
|
|
method = "GET";
|
|
base_url = "https://orion.scylla-hammerhead.ts.net/";
|
|
};
|
|
search.formats = [ "html" "json" ];
|
|
};
|
|
};
|
|
|
|
# searx-init loads EnvironmentFile at spawn. The file must exist before
|
|
# systemd starts that unit. activationScripts run after users/groups and
|
|
# before units, so the first boot/switch cannot race.
|
|
system.activationScripts.searx-secret = {
|
|
deps = [ "users" ];
|
|
text = ''
|
|
install -d -m 0750 -o root -g searx /var/lib/searx
|
|
if [ ! -f /var/lib/searx/secret.env ]; then
|
|
umask 027
|
|
echo "SEARX_SECRET_KEY=$(${pkgs.openssl}/bin/openssl rand -hex 32)" > /var/lib/searx/secret.env
|
|
chown root:searx /var/lib/searx/secret.env
|
|
chmod 0640 /var/lib/searx/secret.env
|
|
fi
|
|
'';
|
|
};
|
|
|
|
# Loopback-only SearXNG, TLS via Tailscale Serve. No host firewall hole.
|
|
# Restart on NoState: during switch, tailscaled can still be coming up.
|
|
systemd.services.tailscale-serve-searx = {
|
|
description = "Advertise SearXNG on Tailscale Serve";
|
|
after = [ "tailscaled.service" "network-online.target" "searx.service" ];
|
|
wants = [ "tailscaled.service" "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
ExecStart = "${pkgs.tailscale}/bin/tailscale serve --bg --yes 8888";
|
|
};
|
|
};
|
|
};
|
|
}
|