feat(services): add SearXNG Quadlet sidecar for self-hosted search - #2
Open
spicectl wants to merge 2 commits into
Open
feat(services): add SearXNG Quadlet sidecar for self-hosted search#2spicectl wants to merge 2 commits into
spicectl wants to merge 2 commits into
Conversation
Deploys searxng/searxng:latest as a Quadlet container managed through Den.
SearXNG aggregates search results from multiple upstream engines,
bypassing the CAPTCHA blocks we keep hitting from the home IP.
- New Den aspect: den.aspects.services.searxng
- Configurable port, base URL, instance name, and agenix-backed secret
- Graceful missing-secret handling with warning message
- Quadlet container with persistent data volume for /etc/searxng
- Wired into hvn-hyp1 host config
Usage:
1. Create the age secret:
agenix -e .secrets/hosts/hvn-hyp1/searxng-secret-key.age
2. agenix rekey
3. Deploy
4. Query at http://hvn-hyp1:8080/search?q=test&format=json
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a configurable SearXNG NixOS module with agenix-backed secret handling and Quadlet container deployment, then enables the service for the ChangesSearXNG service deployment
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant HostConfig
participant SearXNGModule
participant Agenix
participant Quadlet
participant SearXNG
HostConfig->>SearXNGModule: enable service and provide secretKeyFile
SearXNGModule->>Agenix: request secret when age file exists
SearXNGModule->>Quadlet: configure container and published port
Agenix->>SearXNG: provide secret at /run/secrets/<secretName>
Quadlet->>SearXNG: start searxng/searxng:latest
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Summary by QodoAdd SearXNG Quadlet sidecar for self-hosted search on hvn-hyp1
AI Description
Diagram
High-Level Assessment
Files changed (2)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@modules/den/aspects/services/searxng.nix`:
- Around line 67-69: Move the environment.systemPackages assignment into the
lib.mkIf (cfg.enable or false) block so pkgs.curl is installed only when the
SearXNG service is enabled. Keep the existing package assignment unchanged
otherwise and remove it from the unconditional lib.mkMerge argument.
- Around line 56-59: Update the environment construction in the SearXNG service
configuration to read the contents of the secret file and assign those contents
to SEARXNG_SECRET_KEY, rather than exporting the literal file:/run/secrets path.
Preserve SEARXNG_BASE_URL and the existing secretName-based file location.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1e5ce24f-31fc-42e8-a47e-12980f5de8c7
📒 Files selected for processing (2)
modules/den/aspects/services/searxng.nixmodules/den/hosts/hvn-hyp1/default.nix
Code Review by Qodo
1. secretKeyFile wrong type
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+24
to
+27
| secretKeyFile = lib.mkOption { | ||
| type = lib.types.str; | ||
| description = "Path to agenix secret containing SEARXNG_SECRET_KEY."; | ||
| }; |
There was a problem hiding this comment.
1. Secretkeyfile wrong type 🐞 Bug ≡ Correctness
settings.secretKeyFile is declared as lib.types.str, but hvn-hyp1 sets it to a Nix path (inputs.self + "/..."), which will fail option type checking and prevent evaluation/build.
Agent Prompt
## Issue description
`den.aspects.services.searxng.settings.secretKeyFile` is typed as a string, but it is used as a filesystem path (and the host config sets it as a path). This causes an evaluation-time type error.
## Issue Context
Other secret-related options in this repo (e.g., `secretRequests.<name>.ageFile`) are typed as `path`/`nullOr path`.
## Fix Focus Areas
- modules/den/aspects/services/searxng.nix[24-27]
## Suggested fix
- Change `secretKeyFile` option type to `lib.types.path` (or `lib.types.nullOr lib.types.path` with a default).
- If you intentionally want to accept strings, use `lib.types.either lib.types.str lib.types.path` and normalize with `toString`/`/. +` before calling `builtins.pathExists` and passing to `secretRequests`.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
76
to
80
| den.aspects.core."remote-unlock" | ||
| den.aspects.services.mergerfs | ||
| den.aspects.secrets.agenix | ||
| den.aspects.services.searxng | ||
| den.aspects.core.network.tailscale |
There was a problem hiding this comment.
4. Quadlet module not imported 🐞 Bug ≡ Correctness
hvn-hyp1 includes den.aspects.services.searxng, which sets virtualisation.quadlet.containers..., but this host does not include den.aspects.virtualization.podman (the only aspect in this repo that imports/enables Quadlet), so evaluation is likely to fail with an unknown virtualisation.quadlet option.
Agent Prompt
## Issue description
The SearXNG aspect configures `virtualisation.quadlet.containers`, but hvn-hyp1 does not include the virtualization aspect that imports `quadlet-nix` and enables `virtualisation.quadlet`.
## Issue Context
Repo search shows only `den.aspects.virtualization.podman` imports `inputs.quadlet-nix.nixosModules.quadlet` and sets `virtualisation.quadlet.enable = true`.
## Fix Focus Areas
- modules/den/hosts/hvn-hyp1/default.nix[66-83]
- modules/den/aspects/services/searxng.nix[51-65]
- modules/den/aspects/virtualization/podman.nix[12-23]
## Suggested fix
- Add `den.aspects.virtualization.podman` to hvn-hyp1 `includes`, or
- Add `includes = [ den.aspects.virtualization.podman ];` inside the `den.aspects.services.searxng` aspect so it brings its runtime dependency automatically.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
- secretKeyFile is now nullOr str with default null (fixes Nix path type issue) - Mount agenix secret via environmentFiles (SearXNG doesn't support file: prefix in env vars) - Secret file must contain SEARXNG_SECRET_KEY=value format - provisioned guards with null check (avoids pathExists on null) - curl only installed when enabled + provisioned
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Deploys SearXNG as a Quadlet sidecar container managed through Den, giving Hermes a self-hosted search backend that isn't CAPTCHA-blocked.
Changes
modules/den/aspects/services/searxng.nix— Den aspect with configurable port, base URL, instance name, and agenix-backed SEARXNG_SECRET_KEY. Gracefully handles missing secrets with a build warning.den.aspects.services.searxngtohvn-hyp1includes and enabled the service with a secret path.Usage
curl http://localhost:8080/search?q=test&format=jsonSummary by CodeRabbit