system/services/forgejo: enable on ipv4

hosts/anastacia/default.nix

@@ -4,7 +4,9 @@ in {
   imports = [
     ./hardware-configuration.nix
     ./networking.nix # generated at runtime by nixos-infect
+
     "${mod}/services/forgejo.nix"
+    "${mod}/services/searx.nix"
   ];
 
   boot.tmp.cleanOnBoot = true;

system/services/forgejo.nix

@@ -1,6 +1,5 @@
 {
   config,
-  lib,
   pkgs,
   ...
 }: let
@@ -21,7 +20,7 @@ in {
           DOMAIN = "git.nezia.dev";
           HTTP_PORT = 1849;
           ROOT_URL = "https://${srv.DOMAIN}/";
-          HTTP_ADDR = "::1";
+          HTTP_ADDR = "localhost";
         };
         service = {
           DISABLE_REGISTRATION = true;
@@ -35,7 +34,7 @@ in {
     caddy = {
       enable = true;
       virtualHosts."git.nezia.dev".extraConfig = ''
-        reverse_proxy * [::1]:${toString srv.HTTP_PORT}
+        reverse_proxy * localhost:${toString srv.HTTP_PORT}
       '';
     };
   };

system/services/searx.nix

@@ -0,0 +1,51 @@
+{pkgs, ...}: {
+  services = {
+    searx = {
+      enable = true;
+      package = pkgs.searxng;
+      settings = {
+        server = {
+          secret_key = "TODO_USE_SOPS_INSTEAD";
+          port = 8888; # Internal port
+          bind_address = "localhost"; # Only listen locally
+          base_url = "https://search.nezia.dev/";
+          image_proxy = true;
+          default_http_headers = {
+            X-Content-Type-Options = "nosniff";
+            X-XSS-Protection = "1; mode=block";
+            X-Download-Options = "noopen";
+            X-Robots-Tag = "noindex, nofollow";
+            Referrer-Policy = "no-referrer";
+          };
+        };
+        engines = [
+          {
+            name = "qwant";
+            disabled = true;
+          }
+        ];
+      };
+    };
+
+    caddy = {
+      enable = true;
+      virtualHosts."search.nezia.dev" = {
+        extraConfig = ''
+          encode gzip
+          reverse_proxy localhost:8888 {
+            header_up Host {host}
+            header_up X-Real-IP {remote_addr}
+            header_up X-Forwarded-For {remote_addr}
+            header_up X-Forwarded-Proto {scheme}
+          }
+        '';
+      };
+    };
+  };
+
+  # Open required ports
+  networking.firewall = {
+    allowedTCPPorts = [80 443]; # For Caddy
+  };
+}
+