quietsearx/docker-compose.yml at main · KonScanner/quietsearx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
services:
  # Local resolver. It sends every query to base.dns.mullvad.net over
  # DNS-over-TLS. See coredns/Corefile.
  mullvad-dns:
    image: docker.io/coredns/coredns:latest
    container_name: searxng-dns
    command: -conf /etc/coredns/Corefile
    restart: unless-stopped
    networks:
      searxng:
        ipv4_address: 172.30.0.53
    volumes:
      - ./coredns/Corefile:/etc/coredns/Corefile:ro
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    logging:
      driver: json-file
      options:
        max-size: "1m"
        max-file: "1"

  valkey:
    image: docker.io/valkey/valkey:8-alpine
    container_name: searxng-valkey
    command: valkey-server --save 30 1 --loglevel warning
    restart: unless-stopped
    networks:
      searxng:
        ipv4_address: 172.30.0.10
    volumes:
      - valkey-data:/data
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
      - DAC_OVERRIDE
    logging:
      driver: json-file
      options:
        max-size: "1m"
        max-file: "1"

  searxng:
    image: docker.io/searxng/searxng:latest
    container_name: searxng
    restart: unless-stopped
    depends_on:
      - valkey
      - mullvad-dns
    networks:
      - searxng
    ports:
      - "${SEARXNG_PORT:-47821}:8080"
    volumes:
      - ./searxng:/etc/searxng:rw
    # Every outgoing name lookup goes to the CoreDNS container.
    dns:
      - 172.30.0.53
    # The custom DNS replaces the Docker resolver, so map the service name here.
    extra_hosts:
      - "valkey:172.30.0.10"
    environment:
      SEARXNG_BASE_URL: http://localhost:${SEARXNG_PORT:-47821}/
      # There is no default. Put your own key in a .env file. Generate one
      # with: openssl rand -hex 32
      SEARXNG_SECRET: ${SEARXNG_SECRET:?set SEARXNG_SECRET in a .env file, generate one with openssl rand -hex 32}
      UWSGI_WORKERS: ${SEARXNG_UWSGI_WORKERS:-4}
      UWSGI_THREADS: ${SEARXNG_UWSGI_THREADS:-4}
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    logging:
      driver: json-file
      options:
        max-size: "1m"
        max-file: "1"

  # OPT-IN. Egress over Tor. Start it with:  docker compose --profile tor up -d
  # You must also uncomment the "outgoing.proxies" block in searxng/settings.yml.
  tor:
    image: docker.io/osminogin/tor-simple:latest
    container_name: searxng-tor
    profiles: ["tor"]
    restart: unless-stopped
    networks:
      searxng:
        ipv4_address: 172.30.0.20
    logging:
      driver: json-file
      options:
        max-size: "1m"
        max-file: "1"

  # OPT-IN. Cover traffic. It sends decoy searches at random intervals.
  # Start it with:  docker compose --profile cover up -d
  cover-traffic:
    image: docker.io/python:3.13-alpine
    container_name: searxng-cover
    profiles: ["cover"]
    restart: unless-stopped
    depends_on:
      - searxng
    networks:
      - searxng
    volumes:
      - ./cover/cover.py:/cover.py:ro
    command: ["python3", "-u", "/cover.py"]
    environment:
      TARGET: http://searxng:8080
      # The mean interval between decoy searches, in seconds.
      MEAN_INTERVAL: "${COVER_MEAN_INTERVAL:-180}"
      # Set this to the User-Agent that your own browser sends. A decoy that
      # carries a different User-Agent is easy to separate from a real search.
      USER_AGENT: "${COVER_USER_AGENT:-Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36}"
      # Set this to 1 to write the decoy text to the log. Keep it at 0. A log
      # that lists every decoy lets a reader recover your real searches.
      LOG_QUERIES: "${COVER_LOG_QUERIES:-0}"
    logging:
      driver: json-file
      options:
        max-size: "1m"
        max-file: "1"

networks:
  searxng:
    ipam:
      config:
        - subnet: 172.30.0.0/24

volumes:
  valkey-data: