Compare commits

...

2 commits

3 changed files with 55 additions and 3 deletions

View file

@ -4,7 +4,9 @@ in {
imports = [
./hardware-configuration.nix
./networking.nix # generated at runtime by nixos-infect
"${mod}/services/forgejo.nix"
"${mod}/services/searx.nix"
];
boot.tmp.cleanOnBoot = true;

View file

@ -1,6 +1,5 @@
{
config,
lib,
pkgs,
...
}: let
@ -21,7 +20,7 @@ in {
DOMAIN = "git.nezia.dev";
HTTP_PORT = 1849;
ROOT_URL = "https://${srv.DOMAIN}/";
HTTP_ADDR = "::1";
HTTP_ADDR = "localhost";
};
service = {
DISABLE_REGISTRATION = true;
@ -35,7 +34,7 @@ in {
caddy = {
enable = true;
virtualHosts."git.nezia.dev".extraConfig = ''
reverse_proxy * [::1]:${toString srv.HTTP_PORT}
reverse_proxy * localhost:${toString srv.HTTP_PORT}
'';
};
};

51
system/services/searx.nix Normal file
View file

@ -0,0 +1,51 @@
{pkgs, ...}: {
services = {
searx = {
enable = true;
package = pkgs.searxng;
settings = {
server = {
secret_key = "TODO_USE_SOPS_INSTEAD";
port = 8888; # Internal port
bind_address = "localhost"; # Only listen locally
base_url = "https://search.nezia.dev/";
image_proxy = true;
default_http_headers = {
X-Content-Type-Options = "nosniff";
X-XSS-Protection = "1; mode=block";
X-Download-Options = "noopen";
X-Robots-Tag = "noindex, nofollow";
Referrer-Policy = "no-referrer";
};
};
engines = [
{
name = "qwant";
disabled = true;
}
];
};
};
caddy = {
enable = true;
virtualHosts."search.nezia.dev" = {
extraConfig = ''
encode gzip
reverse_proxy localhost:8888 {
header_up Host {host}
header_up X-Real-IP {remote_addr}
header_up X-Forwarded-For {remote_addr}
header_up X-Forwarded-Proto {scheme}
}
'';
};
};
};
# Open required ports
networking.firewall = {
allowedTCPPorts = [80 443]; # For Caddy
};
}