From 07a329f0ac5558f29e9772e0b8708d95a2b0e321 Mon Sep 17 00:00:00 2001 From: hotburger <33610620+hotburger@users.noreply.github.com> Date: Thu, 9 Oct 2025 14:12:57 -0700 Subject: [PATCH 1/6] nixos/searx: remove usage of with lib; --- nixos/modules/services/networking/searx.nix | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index da48474d776c..16dec56fd3d9 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -5,10 +5,18 @@ pkgs, ... }: - -with lib; - let + inherit (lib) + literalExpression + mkDefault + mkIf + mkOption + mkPackageOption + mkRenamedOptionModule + optionalAttrs + types + ; + runDir = "/run/searx"; cfg = config.services.searx; @@ -416,7 +424,7 @@ in networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.server.port ]; }; }; - meta.maintainers = with maintainers; [ + meta.maintainers = with lib.maintainers; [ SuperSandro2000 _999eagle ]; From 5fd47f0f8ffba9ef78c57049d235f655820babcc Mon Sep 17 00:00:00 2001 From: hotburger <33610620+hotburger@users.noreply.github.com> Date: Thu, 9 Oct 2025 14:15:52 -0700 Subject: [PATCH 2/6] nixos/searx: use types from pkgs.formats --- nixos/modules/services/networking/searx.nix | 30 ++++++--------------- 1 file changed, 8 insertions(+), 22 deletions(-) diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index 16dec56fd3d9..da2f6c970321 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -20,13 +20,13 @@ let runDir = "/run/searx"; cfg = config.services.searx; + yamlFormat = pkgs.formats.yaml { }; + tomlFormat = pkgs.formats.toml { }; - settingsFile = pkgs.writeText "settings.yml" ( - builtins.toJSON (removeAttrs cfg.settings [ "redis" ]) - ); + settingsFile = yamlFormat.generate "settings.yml" (builtins.removeAttrs cfg.settings [ "redis" ]); - faviconsSettingsFile = (pkgs.formats.toml { }).generate "favicons.toml" cfg.faviconsSettings; - limiterSettingsFile = (pkgs.formats.toml { }).generate "limiter.toml" cfg.limiterSettings; + faviconsSettingsFile = tomlFormat.generate "favicons.toml" cfg.faviconsSettings; + limiterSettingsFile = tomlFormat.generate "limiter.toml" cfg.limiterSettings; generateConfig = '' cd ${runDir} @@ -37,20 +37,6 @@ let ${pkgs.envsubst}/bin/envsubst < ${settingsFile} > settings.yml ) ''; - - settingType = - with types; - (oneOf [ - bool - int - float - str - (listOf settingType) - (attrsOf settingType) - ]) - // { - description = "JSON value"; - }; in { options = { @@ -115,7 +101,7 @@ in lib.warn "Obsolete option `services.searx.settings.redis' is used. It was renamed to `services.searx.settings.valkey'" config.redis ); - freeformType = settingType; + freeformType = yamlFormat.type; } ); default = { }; @@ -162,7 +148,7 @@ in }; faviconsSettings = mkOption { - type = types.attrsOf settingType; + type = types.attrsOf tomlFormat.type; default = { }; example = literalExpression '' { @@ -190,7 +176,7 @@ in }; limiterSettings = mkOption { - type = types.attrsOf settingType; + type = types.attrsOf tomlFormat.type; default = { }; example = literalExpression '' { From 7463e0c549c089a71a7af03847a9af6cfcdd4820 Mon Sep 17 00:00:00 2001 From: hotburger <33610620+hotburger@users.noreply.github.com> Date: Thu, 9 Oct 2025 14:17:30 -0700 Subject: [PATCH 3/6] nixos/searx: update example limiter config --- nixos/modules/services/networking/searx.nix | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index da2f6c970321..b5d32aa2213a 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -180,14 +180,19 @@ in default = { }; example = literalExpression '' { - real_ip = { - x_for = 1; + botdetection = { ipv4_prefix = 32; ipv6_prefix = 56; - } - botdetection.ip_lists.block_ip = [ - # "93.184.216.34" # example.org - ]; + + trusted_proxies = [ + "127.0.0.0/8" + "::1" + ]; + + ip_lists.block_ip = [ + # "93.184.216.34" # example.org + ]; + }; } ''; description = '' From bbc3c796bae64cab6ae9de1b4e3ea6075dcaf38a Mon Sep 17 00:00:00 2001 From: hotburger <33610620+hotburger@users.noreply.github.com> Date: Fri, 24 Oct 2025 20:22:00 -0700 Subject: [PATCH 4/6] nixos/searx: unify config file locations --- nixos/modules/services/networking/searx.nix | 28 +++++++++++---------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index b5d32aa2213a..5a38da1e059c 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -31,10 +31,22 @@ let generateConfig = '' cd ${runDir} - # write NixOS settings as JSON + # write NixOS settings ( umask 077 - ${pkgs.envsubst}/bin/envsubst < ${settingsFile} > settings.yml + ${lib.getExe pkgs.envsubst} < ${settingsFile} > settings.yml + ${ + if (cfg.faviconsSettings != { }) then + "ln -sf ${faviconsSettingsFile} favicons.toml" + else + "rm -f favicons.toml" + } + ${ + if (cfg.limiterSettings != { }) then + "ln -sf ${limiterSettingsFile} limiter.toml" + else + "rm -f limiter.toml" + } ) ''; in @@ -263,17 +275,7 @@ in } ]; - environment = { - etc = { - "searxng/favicons.toml" = lib.mkIf (cfg.faviconsSettings != { }) { - source = faviconsSettingsFile; - }; - "searxng/limiter.toml" = lib.mkIf (cfg.limiterSettings != { }) { - source = limiterSettingsFile; - }; - }; - systemPackages = [ cfg.package ]; - }; + environment.systemPackages = [ cfg.package ]; services = { nginx = lib.mkIf cfg.configureNginx { From 0e10ab2b40f84e7d59ffaf97d244391df8094a6a Mon Sep 17 00:00:00 2001 From: hotburger <33610620+hotburger@users.noreply.github.com> Date: Fri, 27 Feb 2026 12:56:45 -0800 Subject: [PATCH 5/6] nixos/searx: rename settingsFile to settingsPath --- nixos/modules/services/networking/searx.nix | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index 5a38da1e059c..dc31c10c9874 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -142,19 +142,19 @@ in ''; }; - settingsFile = mkOption { + settingsPath = mkOption { type = types.path; - default = "${runDir}/settings.yml"; + default = runDir; description = '' - The path of the Searx server settings.yml file. - If no file is specified, a default file is used (default config file has debug mode enabled). + The path of the SearXNG settings directory or the settings.yml file. + If no path is specified, a default one is used (default config file has debug mode enabled). ::: {.note} Setting this options overrides [](#opt-services.searx.settings). ::: ::: {.warning} - This file, along with any secret key it contains, will be copied into the world-readable Nix store. + This path, along with any secret keys it contains, will be copied into the world-readable Nix store. ::: ''; }; @@ -263,6 +263,7 @@ in }; imports = [ + (mkRenamedOptionModule [ "services" "searx" "settingsFile" ] [ "services" "searx" "settingsPath" ]) (mkRenamedOptionModule [ "services" "searx" "configFile" ] [ "services" "searx" "settingsFile" ]) (mkRenamedOptionModule [ "services" "searx" "runInUwsgi" ] [ "services" "searx" "configureUwsgi" ]) ]; @@ -339,7 +340,7 @@ in enable-threads = true; module = "searx.webapp"; env = [ - "SEARXNG_SETTINGS_PATH=${cfg.settingsFile}" + "SEARXNG_SETTINGS_PATH=${cfg.settingsPath}" ]; buffer-size = 32768; pythonPackages = _: [ cfg.package ]; @@ -390,7 +391,7 @@ in EnvironmentFile = cfg.environmentFile; }; environment = { - SEARXNG_SETTINGS_PATH = cfg.settingsFile; + SEARXNG_SETTINGS_PATH = cfg.settingsPath; }; }; @@ -399,7 +400,7 @@ in after = [ "searx-init.service" ]; restartTriggers = [ cfg.package - cfg.settingsFile + cfg.settingsPath ] ++ lib.optional (cfg.environmentFile != null) cfg.environmentFile; }; From d78b9e46d5d606347b022a1b7104e15641a9e57a Mon Sep 17 00:00:00 2001 From: hotburger <33610620+hotburger@users.noreply.github.com> Date: Fri, 27 Feb 2026 12:43:29 -0800 Subject: [PATCH 6/6] nixos/searx: harden systemd service --- nixos/modules/services/networking/searx.nix | 45 ++++++++++++++++++++- 1 file changed, 44 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix index dc31c10c9874..6baf331187ec 100644 --- a/nixos/modules/services/networking/searx.nix +++ b/nixos/modules/services/networking/searx.nix @@ -381,11 +381,54 @@ in after = [ "searx-init.service" "network.target" - ]; + ] + ++ lib.optionals cfg.redisCreateLocally [ "redis-searx.service" ]; serviceConfig = { User = "searx"; + DynamicUser = true; Group = "searx"; ExecStart = lib.getExe cfg.package; + + CacheDirectory = "searx"; + CacheDirectoryMode = "0700"; + + ReadOnlyPaths = [ cfg.settingsPath ]; + ReadWritePaths = lib.optional cfg.redisCreateLocally config.services.redis.servers.searx.unixSocket; + + CapabilityBoundingSet = null; + DevicePolicy = "closed"; + LockPersonality = true; + MemoryDenyWriteExecute = true; + NoNewPrivileges = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + ProtectProc = "invisible"; + ProtectSystem = "strict"; + PrivateDevices = true; + PrivateMounts = true; + PrivateTmp = true; + PrivateUsers = true; + PrivateIPC = true; + RemoveIPC = true; + RestrictAddressFamilies = [ + "AF_INET" + "AF_INET6" + "AF_UNIX" + ]; + RestrictNamespaces = true; + RestrictRealtime = true; + SystemCallArchitectures = "native"; + SystemCallErrorNumber = "EPERM"; + SystemCallFilter = [ + "@system-service" + "~@privileged @resources" + ]; + UMask = "0077"; } // optionalAttrs (cfg.environmentFile != null) { EnvironmentFile = cfg.environmentFile;