Merge pull request #293 from 0fficersally/0fficersally

Update `valkey:7-alpine` to `valkey:8-alpine` in `README.md`

.env

@@ -5,3 +5,10 @@
 
 # SEARXNG_HOSTNAME=<host>
 # LETSENCRYPT_EMAIL=<email>
+
+# Optional:
+# If you run a very small or a very large instance, you might want to change the amount of used uwsgi workers and threads per worker
+# More workers (= processes) means that more search requests can be handled at the same time, but it also causes more resource usage
+
+# SEARXNG_UWSGI_WORKERS=4
+# SEARXNG_UWSGI_THREADS=4

.github/workflows/security.yml

@@ -1,27 +0,0 @@
-name: "Security checks"
-on:
-  schedule:
-    - cron: "05 06 * * *"
-  workflow_dispatch:
-
-jobs:
-  dockers:
-    name: Trivy ${{ matrix.image }}
-    runs-on: ubuntu-20.04
-    strategy:
-      fail-fast: false
-      matrix:
-        image: ["searxng/searxng", "dalf/filtron", "dalf/morty"]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: '${{ matrix.image }}:latest'
-          format: 'table'
-          exit-code: '1'
-          ignore-unfixed: false
-          vuln-type: 'os,library'
-          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'

Caddyfile

@@ -92,6 +92,7 @@
         reverse_proxy localhost:8080 {
                header_up X-Forwarded-Port {http.request.port}
                header_up X-Forwarded-Proto {http.request.scheme}
+               header_up X-Real-IP {remote_host}
         }
   }
 

README.md

@@ -1,37 +1,62 @@
 # searxng-docker
 
-Create a new SearXNG  instance in five minutes using Docker
+Create a new SearXNG instance in five minutes using Docker
 
 ## What is included ?
 
 | Name | Description | Docker image | Dockerfile |
 | -- | -- | -- | -- |
-| [Caddy](https://github.com/caddyserver/caddy) | Reverse proxy (create a LetsEncrypt certificate automatically) | [caddy/caddy:2-alpine](https://hub.docker.com/_/caddy) | [Dockerfile](https://github.com/caddyserver/caddy-docker) |
-| [SearXNG](https://github.com/searxng/searxng) | SearXNG by itself | [searxng/searxng:latest](https://hub.docker.com/r/searxng/searxng) | [Dockerfile](https://github.com/searxng/searxng/blob/master/Dockerfile) |
-| [Redis](https://github.com/redis/redis) | In-memory database | [redis:alpine](https://hub.docker.com/_/redis) | [Dockerfile-alpine.template](https://github.com/docker-library/redis/blob/master/Dockerfile-alpine.template) |
+| [Caddy](https://github.com/caddyserver/caddy) | Reverse proxy (create a LetsEncrypt certificate automatically) | [docker.io/library/caddy:2-alpine](https://hub.docker.com/_/caddy)           | [Dockerfile](https://github.com/caddyserver/caddy-docker/blob/master/Dockerfile.tmpl) |
+| [SearXNG](https://github.com/searxng/searxng) | SearXNG by itself                                              | [docker.io/searxng/searxng:latest](https://hub.docker.com/r/searxng/searxng) | [Dockerfile](https://github.com/searxng/searxng/blob/master/Dockerfile)               |
+| [Valkey](https://github.com/valkey-io/valkey) | In-memory database                                             | [docker.io/valkey/valkey:8-alpine](https://hub.docker.com/r/valkey/valkey)        | [Dockerfile](https://github.com/valkey-io/valkey-container/blob/mainline/Dockerfile.template)             |
 
 ## How to use it
-- [Install docker](https://docs.docker.com/install/)
-- [Install docker-compose](https://docs.docker.com/compose/install/) (be sure that docker-compose version is at least 1.9.0)
-- Get searxng-docker
+There are two ways to host SearXNG. The first one doesn't require any prior knowledge about self-hosting and thus is recommended for beginners. It includes caddy as a reverse proxy and automatically deals with the TLS certificates for you. The second one is recommended for more advanced users that already have their own reverse proxy (e.g. Nginx, HAProxy, ...) and probably some other services running on their machine. The first few steps are the same for both installation methods however.
+
+1. [Install docker](https://docs.docker.com/install/)
+2. Get searxng-docker
   ```sh
   cd /usr/local
   git clone https://github.com/searxng/searxng-docker.git
   cd searxng-docker
   ```
-- Edit the [.env](https://github.com/searxng/searxng-docker/blob/master/.env) file to set the hostname and an email
-- Generate the secret key ```sed -i "s|ultrasecretkey|$(openssl rand -hex 32)|g" searxng/settings.yml```
-- Edit the [searxng/settings.yml](https://github.com/searxng/searxng-docker/blob/master/searxng/settings.yml) file according to your need
-- Check everything is working: ```docker-compose up```
-- Run SearXNG in the background: ```docker-compose up -d```
+3. Edit the [.env](https://github.com/searxng/searxng-docker/blob/master/.env) file to set the hostname and an email
+4. Generate the secret key `sed -i "s|ultrasecretkey|$(openssl rand -hex 32)|g" searxng/settings.yml`
+5. Edit [searxng/settings.yml](https://github.com/searxng/searxng-docker/blob/master/searxng/settings.yml) according to your needs
 
-## How to access the logs
-To access the logs from all the containers use: `docker-compose logs -f`.
+> [!NOTE]
+> On the first run, you must remove `cap_drop: - ALL` from the `docker-compose.yaml` file for the `searxng` service to successfully create `/etc/searxng/uwsgi.ini`. This is necessary because the `cap_drop: - ALL` directive removes all capabilities, including those required for the creation of the `uwsgi.ini` file. After the first run, you should re-add `cap_drop: - ALL` to the `docker-compose.yaml` file for security reasons.
+
+> [!NOTE]
+> Windows users can use the following powershell script to generate the secret key:
+> ```powershell
+> $randomBytes = New-Object byte[] 32
+> (New-Object Security.Cryptography.RNGCryptoServiceProvider).GetBytes($randomBytes)
+> $secretKey = -join ($randomBytes | ForEach-Object { "{0:x2}" -f $_ })
+> (Get-Content searxng/settings.yml) -replace 'ultrasecretkey', $secretKey | Set-Content searxng/settings.yml
+> ```
+
+### Method 1: With Caddy included (recommended for beginners)
+6. Run SearXNG in the background: `docker compose up -d`
+
+### Method 2: Bring your own reverse proxy (experienced users)
+6. Remove the caddy related parts in `docker-compose.yaml` such as the caddy service and its volumes.
+7. Point your reverse proxy to the port set for the `searxng` service in `docker-compose.yml` (8080 by default).
+8. Generate and configure the required TLS certificates with the reverse proxy of your choice.
+9. Run SearXNG in the background: `docker compose up -d`
+
+> [!NOTE]
+> You can change the port `searxng` listens on inside the docker container (e.g. if you want to operate in `host` network mode) with the `BIND_ADDRESS` environment variable (defaults to `0.0.0.0:8080`). The environment variable can be set directly inside `docker-compose.yaml`.
+
+## Troubleshooting - How to access the logs
+
+To access the logs from all the containers use: `docker compose logs -f`.
 
 To access the logs of one specific container:
-- Caddy: `docker-compose logs -f caddy`
-- SearXNG: `docker-compose logs -f searxng`
-- Redis: `docker-compose logs -f redis`
+
+- Caddy: `docker compose logs -f caddy`
+- SearXNG: `docker compose logs -f searxng`
+- Valkey: `docker compose logs -f redis`
 
 ### Start SearXNG with systemd
 
@@ -51,11 +76,12 @@ The SearXNG image proxy is activated by default.
 
 The default [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) allow the browser to access to ```${SEARXNG_HOSTNAME}``` and ```https://*.tile.openstreetmap.org;```.
 
-If some users wants to disable the image proxy, you have to modify [./Caddyfile](https://github.com/searxng/searxng-docker/blob/master/Caddyfile). Replace the ```img-src 'self' data: https://*.tile.openstreetmap.org;``` by ```img-src * data:;```.
+If some users want to disable the image proxy, you have to modify [./Caddyfile](https://github.com/searxng/searxng-docker/blob/master/Caddyfile). Replace the ```img-src 'self' data: https://*.tile.openstreetmap.org;``` by ```img-src * data:;```.
 
 ## Multi Architecture Docker images
 
 Supported architecture:
+
 - amd64
 - arm64
 - arm/v7
@@ -65,11 +91,15 @@ Supported architecture:
 To update the SearXNG stack:
 
 ```sh
-docker-compose pull
-docker-compose down
-docker-compose up
+git pull
+docker compose pull
+docker compose up -d
 ```
 
-To update this `docker-compose.yml` file:
+Or the old way (with the old docker-compose version):
 
-Check out the newest version on github: [searxng/searxng-docker](https://github.com/searxng/searxng-docker).
+```sh
+git pull
+docker-compose pull
+docker-compose up -d
+```

docker-compose.yaml

@@ -1,11 +1,11 @@
-version: '3.7'
+version: "3.7"
 
 services:
-
   caddy:
     container_name: caddy
-    image: caddy:2-alpine
+    image: docker.io/library/caddy:2-alpine
     network_mode: host
+    restart: unless-stopped
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy-data:/data:rw
@@ -17,38 +17,24 @@ services:
       - ALL
     cap_add:
       - NET_BIND_SERVICE
-      - DAC_OVERRIDE
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "1m"
+        max-file: "1"
 
   redis:
     container_name: redis
-    image: "redis:alpine"
-    command: redis-server --save "" --appendonly "no"
+    image: docker.io/valkey/valkey:8-alpine
+    command: valkey-server --save 30 1 --loglevel warning
+    restart: unless-stopped
     networks:
       - searxng
-    tmpfs:
-      - /var/lib/redis
-    cap_drop:
-      - ALL
-    cap_add:
-      - SETGID
-      - SETUID
-      - DAC_OVERRIDE
-
-  searxng:
-    container_name: searxng
-    image: searxng/searxng:latest
-    networks:
-      - searxng
-    ports:
-     - "127.0.0.1:8080:8080"
     volumes:
-      - ./searxng:/etc/searxng:rw
-    environment:
-      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
+      - valkey-data2:/data
     cap_drop:
       - ALL
     cap_add:
-      - CHOWN
       - SETGID
       - SETUID
       - DAC_OVERRIDE
@@ -57,11 +43,37 @@ services:
       options:
         max-size: "1m"
         max-file: "1"
+
+  searxng:
+    container_name: searxng
+    image: docker.io/searxng/searxng:latest
+    restart: unless-stopped
+    networks:
+      - searxng
+    ports:
+      - "127.0.0.1:8080:8080"
+    volumes:
+      - ./searxng:/etc/searxng:rw
+    environment:
+      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
+      - UWSGI_WORKERS=${SEARXNG_UWSGI_WORKERS:-4}
+      - UWSGI_THREADS=${SEARXNG_UWSGI_THREADS:-4}
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "1m"
+        max-file: "1"
+
 networks:
   searxng:
-    ipam:
-      driver: default
 
 volumes:
   caddy-data:
   caddy-config:
+  valkey-data2:

searxng-docker.service.template

@@ -9,8 +9,8 @@ Restart=on-failure
 Environment=SEARXNG_DOCKERCOMPOSEFILE=docker-compose.yaml
 
 WorkingDirectory=/usr/local/searxng-docker
-ExecStart=/usr/local/bin/docker-compose -f ${SEARXNG_DOCKERCOMPOSEFILE} up --remove-orphans
-ExecStop=/usr/local/bin/docker-compose -f ${SEARXNG_DOCKERCOMPOSEFILE} down
+ExecStart=/usr/local/bin/docker compose -f ${SEARXNG_DOCKERCOMPOSEFILE} up --remove-orphans
+ExecStop=/usr/local/bin/docker compose -f ${SEARXNG_DOCKERCOMPOSEFILE} down
 
 [Install]
 WantedBy=multi-user.target

searxng/limiter.toml

@@ -0,0 +1,6 @@
+# This configuration file updates the default configuration file
+# See https://github.com/searxng/searxng/blob/master/searx/limiter.toml
+
+[botdetection.ip_limit]
+# activate link_token method in the ip_limit method
+link_token = true

searxng/settings.yml

@@ -1,4 +1,4 @@
-# see https://docs.searxng.org/admin/engines/settings.html#use-default-settings
+# see https://docs.searxng.org/admin/settings/settings.html#settings-use-default-settings
 use_default_settings: true
 server:
   # base_url is defined in the SEARXNG_BASE_URL environment variable, see .env and docker-compose.yml