drmathias/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove search

Browse Source
This commit is contained in:
Adam
2025-09-25 10:15:32 +01:00
parent 29908f7f8a
commit 718ee67d0b
9 changed files with 14 additions and 246 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gateway/authelia/config/configuration.yml
+7 -7
View File
@@ -44,7 +44,7 @@ server:
endpoints:
authz:
forward-auth:
implementation: 'ForwardAuth'
implementation: "ForwardAuth"
# SMTP Notifier https://www.authelia.com/configuration/notifications/smtp/
# Set also AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE
@@ -90,14 +90,14 @@ identity_providers:
client_name: Gitea
client_secret: {{ secret "/run/secrets/GITEA_CLIENT_SECRET" }}
public: false
authorization_policy: 'two_factor'
authorization_policy: "two_factor"
consent_mode: pre-configured
token_endpoint_auth_method: 'client_secret_basic'
token_endpoint_auth_method: "client_secret_post"
pre_configured_consent_duration: 1w
scopes:
- 'openid'
- 'email'
- 'profile'
- "openid"
- "email"
- "profile"
redirect_uris:
- https://gitea.64815139.xyz/user/oauth2/Authelia/callback
- client_id: Qzmj9S-sJi0bDpUFhuJgqwJPiiGqEBtUGLmjqcZxFpLfQzb7Y9LxnmvZ2K1YoZT2vAXDqWi5
@@ -106,7 +106,7 @@ identity_providers:
public: false
authorization_policy: two_factor
consent_mode: pre-configured
token_endpoint_auth_method: 'client_secret_basic'
token_endpoint_auth_method: "client_secret_post"
pre_configured_consent_duration: 1w
scopes:
- openid
gateway/caddy/Caddyfile
+4 -98
View File
@@ -50,125 +50,31 @@ www.64815139.xyz {
redir https://www.{host}{uri}
}
search.64815139.xyz {
log {
output discard
}
import secure *
@api {
path /config
path /healthz
path /stats/errors
path /stats/checker
}
@static {
path /static/*
}
@notstatic {
not path /static/*
}
@imageproxy {
path /image_proxy
}
@notimageproxy {
not path /image_proxy
}
header {
# Enable HTTP Strict Transport Security (HSTS) to force clients to always connect via HTTPS
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# Enable cross-site filter (XSS) and tell browser to block detected attacks
X-XSS-Protection "1; mode=block"
# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
X-Content-Type-Options "nosniff"
# Disable some features
Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()"
# Disable some features (legacy)
Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'"
# Referer
Referrer-Policy "no-referrer"
# X-Robots-Tag
X-Robots-Tag "noindex, noarchive, nofollow"
# Remove Server header
-Server
}
header @api {
Access-Control-Allow-Methods "GET, OPTIONS"
Access-Control-Allow-Origin "*"
}
# Cache
header @static {
# Cache
Cache-Control "public, max-age=31536000"
defer
}
header @notstatic {
# No Cache
Cache-Control "no-cache, no-store"
Pragma "no-cache"
}
# CSP (see http://content-security-policy.com/ )
header @imageproxy {
Content-Security-Policy "default-src 'none'; img-src 'self' data:"
}
header @notimageproxy {
Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com"
}
handle {
encode zstd gzip
reverse_proxy 192.168.0.210:8080 {
header_up X-Forwarded-Port {http.request.port}
header_up X-Forwarded-Proto {http.request.scheme}
header_up X-Real-IP {remote_host}
}
}
}
gitea.64815139.xyz {
route {
crowdsec
rewrite /user/login /user/oauth2/Authelia
reverse_proxy 192.168.0.210:3000
reverse_proxy 192.168.0.216:3000
}
}
immich.64815139.xyz {
route {
crowdsec
reverse_proxy 192.168.0.210:2283
reverse_proxy 192.168.0.216:2283
}
}
uptime.64815139.xyz {
route {
crowdsec
reverse_proxy 192.168.0.210:4393
reverse_proxy 192.168.0.216:4393
}
}
oaT3cqYuCAegcoM4Xc4Pun1BUMOschxR.64815139.xyz {
route {
crowdsec
reverse_proxy 192.168.0.210:4449
reverse_proxy 192.168.0.216:4449
}
}
gateway/cloudflare-ddns/config.json
-4
View File
@@ -18,10 +18,6 @@
"name": "auth",
"proxied": false
},
{
"name": "search",
"proxied": false
},
{
"name": "gitea",
"proxied": false
immich/.env
+1
View File
@@ -10,6 +10,7 @@ DB_DATA_LOCATION=./data/postgres
# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release
IMMICH_HOST=0.0.0.0
# The values below this line do not need to be changed
###################################################################################
immich/docker-compose.yml
+2 -7
View File
@@ -62,7 +62,7 @@ services:
database:
container_name: immich_postgres
image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
secrets:
- POSTGRES_PASSWORD
environment:
@@ -73,12 +73,7 @@ services:
volumes:
# Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
- ${DB_DATA_LOCATION}:/var/lib/postgresql/data
healthcheck:
test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
interval: 5m
start_interval: 30s
start_period: 5m
command: ["postgres", "-c", "shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]
shm_size: 128mb
restart: always
volumes:
searxng/config/limiter.toml
-6
View File
@@ -1,6 +0,0 @@
# This configuration file updates the default configuration file
# See https://github.com/searxng/searxng/blob/master/searx/limiter.toml
[botdetection.ip_limit]
# activate link_token method in the ip_limit method
link_token = true
searxng/config/settings.yml
-9
View File
@@ -1,9 +0,0 @@
# see https://docs.searxng.org/admin/settings/settings.html#settings-use-default-settings
use_default_settings: true
server:
limiter: false # can be disabled for a private instance
image_proxy: true
ui:
static_use_hash: true
redis:
url: redis://redis:6379/0
searxng/config/uwsgi.ini
-54
View File
@@ -1,54 +0,0 @@
[uwsgi]
# Who will run the code
uid = searxng
gid = searxng
# Number of workers (usually CPU count)
# default value: %k (= number of CPU core, see Dockerfile)
workers = 2
# Number of threads per worker
# default value: 4 (see Dockerfile)
threads = 2
# The right granted on the created socket
chmod-socket = 666
# Plugin to use and interpreter config
single-interpreter = true
master = true
plugin = python3
lazy-apps = true
enable-threads = 2
# Module to import
module = searx.webapp
# Virtualenv and python path
pythonpath = /usr/local/searxng/
chdir = /usr/local/searxng/searx/
# automatically set processes name to something meaningful
auto-procname = true
# Disable request logging for privacy
disable-logging = true
log-5xx = true
# Set the max size of a request (request-body excluded)
buffer-size = 8192
# No keep alive
# See https://github.com/searx/searx-docker/issues/24
add-header = Connection: close
# Follow SIGTERM convention
# See https://github.com/searxng/searxng/issues/3427
die-on-term
# uwsgi serves the static files
static-map = /static=/usr/local/searxng/searx/static
# expires set to one day
static-expires = /* 86400
static-gzip-all = True
offload-threads = 2
searxng/docker-compose.yaml
-61
View File
@@ -1,61 +0,0 @@
name: searxng
secrets:
SECRET_KEY:
file: './secrets/SECRET_KEY'
services:
redis:
container_name: searxng_redis
image: docker.io/valkey/valkey:8-alpine
command: valkey-server --save 30 1 --loglevel warning
restart: unless-stopped
networks:
- default
volumes:
- valkey-data:/data
cap_drop:
- ALL
cap_add:
- SETGID
- SETUID
- DAC_OVERRIDE
logging:
driver: "json-file"
options:
max-size: "1m"
max-file: "1"
searxng:
container_name: searxng_app
image: docker.io/searxng/searxng:latest
restart: unless-stopped
networks:
- default
ports:
- "8080:8080"
volumes:
- ./config:/etc/searxng:rw
secrets:
- SECRET_KEY
environment:
- SEARXNG_BASE_URL=https://search.64815139.xyz
- SEARXNG_SECRET= /run/secrets/SECRET_KEY
- UWSGI_WORKERS=4
- UWSGI_THREADS=4
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
logging:
driver: "json-file"
options:
max-size: "1m"
max-file: "1"
networks:
default:
external: false
volumes:
valkey-data: