8 files changed, 151 insertions, 21 deletions
diff --git a/group_vars/all/vars.yaml b/group_vars/all/vars.yaml
index f5c2645..87c5503 100644
--- a/group_vars/all/vars.yaml
+++ b/group_vars/all/vars.yaml
@@ -14,6 +14,9 @@ apps_conf_map:
   bitwarden:
     port: 31901
     access_domain: 'vault.{{ apps_domain }}'
+  searxng:
+    port: 31902
+    access_domain: 'search.{{ apps_domain }}'
 
 # list all static websites you plan to host here.
 nginx_websites:
diff --git a/group_vars/all/vault b/group_vars/all/vault
index dc9ea53..901350b 100644
--- a/group_vars/all/vault
+++ b/group_vars/all/vault
@@ -1,22 +1,24 @@
 $ANSIBLE_VAULT;1.1;AES256
-61313937646535376164373732663565313030623462656561303936653432313733643430376663
-3838336661336338383633333565386635663532653861630a386136616565396234363531336234
-65346162313632336331343832643338376431343761313731323039363637626533643562366362
-6433663639353066630a616230663162633463323435336361383238333031653930316637393836
-36626662653563383936666662346130613835343231613030373532363331373735373636376363
-35373963353465313930323765396362356166646166623832613930633565393838616365336362
-38323639666333623539373830643232653432633963373733663436373436393832386231366262
-39343661326131623031626565333835663730643831333263336134333630376338633261633835
-63306138393439326430613338643066366461323330643837346130623465366335343831396437
-33393939323264663163643935656663386537393265643364333132623830373766623933353865
-63323638383164353435323161363339333966663466333832396162383230313732656366643430
-66343163366164626438303432346331386165313037353532383939663038343766313736323930
-62653932396430373337653862353965623135323632666630303337636566623738346261666338
-37626364343764623333613030653130646662613930383462343664643737336533646235306437
-65376566353331623737323036613638333831633039373430653430386636346538346335623566
-61333735396431633566303265613135366437646164626437353139396235383133383436306235
-66626433613535333061363466333865333736383238353534653765393937663731623138616164
-35663161323735613563376463333539333062346463326564353736646639636535313236323736
-37383230336434633035633563646638666333373730633431313864336462656139336134383438
-66353039393931363831323164653964666662613062333765306435363533643063353033326631
-3064
+35303436363137363039306264356561303133613433613064356632356133616238353531623161
+3131336462653930623037323863383661616265623538660a373263303630646132306562646263
+66303365613431636166316434636461646363333433663031393930626362623337343037336332
+6630653062653039620a633838643166373337316235663363633665613336646534636564646165
+32643062343335313765323266303961366337663233353632333033303463633032623836343463
+38623062393666613331393465383761353235336539633739366333363739363938636561343861
+35346534393565663539353163316230643363343639653030623938353338346638326662373565
+31323736303232346534366536343465386337373636373436383966323732336636656331313631
+38613430666565393132306232626666373362656538306561333535323532666538373766373132
+63316131626232386465316433363239353965383734633366643330646130376263323163633466
+62666466636464666435373564666637343632373362376165626332663732643631323665623839
+63656637633032316264313562313937353265386561353665353161663830393865363834396337
+63666662663763666337656339396339343463643632363639386432356361313664306330366130
+31613734383238333335353863376162626634353839393565306561383764393930333038636538
+35363835616531366664666436616566303338623536366131616239323132393866366434653733
+65626338653866376636393437343132623936626432306134343664363362366666343337666635
+35323535616461323966333165396163383532303561343665393335343963353539376162616264
+31363962646461663834393666316164376533653064313466643364323236623961306432636336
+64653265393765383838646534623966313137356531346662623936643039663861666364396431
+64326339623238633138633166633565343032393863356534366636353362636331383833356334
+33346533643462643062363834313436633337363466643932636431333838343539663863626164
+36376536336465393063313136353831646132336437333366333034346635333837633431623538
+396433393039353238646666323730306166
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index 9ba8c3b..270416d 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -88,6 +88,18 @@
 
 - hosts: compute
   gather_facts: false
+  tags: 'searxng'
+  become: true
+  roles:
+    - role: searxng
+      vars:
+        searxng_domain: '{{ apps_conf_map["searxng"]["access_domain"] }}'
+        searxng_host_port: '{{ apps_conf_map["searxng"]["port"] }}'
+        searxng_data_root: '{{ data_vol_hdd }}/searxng'
+        searxng_secret_key: '{{ vault_searxng_secret_key }}'
+
+- hosts: compute
+  gather_facts: false
   tags: 'bitwarden'
   become: true
   roles:
diff --git a/roles/nginx/templates/app.nginx.conf.j2 b/roles/nginx/templates/app.nginx.conf.j2
index c87fe29..82c3610 100644
--- a/roles/nginx/templates/app.nginx.conf.j2
+++ b/roles/nginx/templates/app.nginx.conf.j2
@@ -8,7 +8,11 @@ server {
     ssl_ciphers         HIGH:!aNULL:!MD5;
 
     location / {
+{% if item.app == "nextcloud" %} {# Nextcloud requires https internally #}
+        proxy_pass         https://127.0.0.1:{{ item.conf.port }};
+{% else %}
         proxy_pass         http://127.0.0.1:{{ item.conf.port }};
+{% endif %}
         proxy_set_header   Host $host;
         proxy_set_header   X-Real-IP $remote_addr;
         proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
diff --git a/roles/searxng/defaults/main.yaml b/roles/searxng/defaults/main.yaml
new file mode 100644
index 0000000..b437c19
--- /dev/null
+++ b/roles/searxng/defaults/main.yaml
@@ -0,0 +1,14 @@
+# Default Values
+---
+
+# Playbook dependent.
+searxng_domain: ''
+searxng_host_port: ''
+searxng_data_root: ''
+searxng_secret_key: ''
+
+# Role defaults.
+searxng_tz: 'America/Toronto'
+searxng_docker_network_name: 'searxng_network'
+searxng_url: 'https://{{ searxng_domain }}/'
+searxng_redis_container_name: 'searxng-redis'
diff --git a/roles/searxng/handlers/main.yaml b/roles/searxng/handlers/main.yaml
new file mode 100644
index 0000000..7bee977
--- /dev/null
+++ b/roles/searxng/handlers/main.yaml
@@ -0,0 +1,15 @@
+---
+
+- name: 'Restart Redis container'
+  community.docker.docker_container:
+    name: '{{ searxng_redis_container_name }}'
+    state: 'started'
+    restart: true
+  listen: 'redis_restart'
+
+- name: 'Restart Searxng container'
+  community.docker.docker_container:
+    name: 'searxng'
+    state: 'started'
+    restart: true
+  listen: 'searxng_restart'
diff --git a/roles/searxng/tasks/main.yaml b/roles/searxng/tasks/main.yaml
new file mode 100644
index 0000000..668594b
--- /dev/null
+++ b/roles/searxng/tasks/main.yaml
@@ -0,0 +1,69 @@
+# https://docs.searxng.org/admin/installation-docker.html#installation-docker
+---
+
+- name: 'Create Searxng data dir'
+  file:
+    path: '{{ searxng_data_root }}'
+    state: 'directory'
+    owner: '{{ ansible_user }}'
+    group: '{{ ansible_user }}'
+    mode: '755'
+
+- name: 'Copy over searxng settings file to data dir'
+  template:
+    src: 'settings.yaml.j2'
+    dest: '{{ searxng_data_root }}/settings.yml'
+    owner: '{{ ansible_user }}'
+    group: '{{ ansible_user }}'
+    mode: '644'
+  notify:
+    - 'redis_restart'
+    - 'searxng_restart'
+
+- name: 'Create the Searxng network'
+  community.docker.docker_network:
+    name: '{{ searxng_docker_network_name }}'
+    ipam_driver: 'default'
+    state: 'present'
+
+- name: 'Make sure the Redis container is created and running'
+  community.docker.docker_container:
+    name: '{{ searxng_redis_container_name }}'
+    image: 'redis:alpine'
+    command: 'redis-server --save "" --appendonly "no"'
+    networks:
+      - name: '{{ searxng_docker_network_name }}'
+    tmpfs:
+      - '/var/lib/redis'
+    cap_drop:
+      - 'ALL'
+    capabilities:
+      - 'SETGID'
+      - 'SETUID'
+      - 'DAC_OVERRIDE'
+    state: 'started'
+
+- name: 'Make sure the Searxng container is created and running'
+  community.docker.docker_container:
+    name: 'searxng'
+    image: 'searxng/searxng:latest'
+    networks:
+      - name: '{{ searxng_docker_network_name }}'
+    ports:
+      - '0.0.0.0:{{ searxng_host_port }}:8080'
+    volumes:
+      - '{{ searxng_data_root }}/:/etc/searxng:rw'
+    env:
+      TZ': '{{ searxng_tz }}'
+    cap_drop:
+      - 'ALL'
+    capabilities:
+      - 'CHOWN'
+      - 'SETGID'
+      - 'SETUID'
+      - 'DAC_OVERRIDE'
+    log_driver: 'json-file'
+    log_options:
+      max-size: '1m'
+      max-file: '1'
+    state: 'started'
diff --git a/roles/searxng/templates/settings.yaml.j2 b/roles/searxng/templates/settings.yaml.j2
new file mode 100644
index 0000000..eb49cfd
--- /dev/null
+++ b/roles/searxng/templates/settings.yaml.j2
@@ -0,0 +1,11 @@
+# see https://docs.searxng.org/admin/engines/settings.html#use-default-settings
+use_default_settings: true
+server:
+  base_url: "{{ searxng_url }}"
+  secret_key: "{{ searxng_secret_key }}"
+  limiter: false  # can be disabled for a private instance
+  image_proxy: true
+ui:
+  static_use_hash: true
+redis:
+  url: redis://{{ searxng_redis_container_name }}:6379/0