From 6218f62408fee1d6472a3af7faeebf1052edc0e9 Mon Sep 17 00:00:00 2001
From: Ryan Westfall <ryan@aimloperations.com>
Date: Sun, 2 Aug 2026 13:42:58 -0500
Subject: [PATCH] Fix SearxNG crash loop: make settings.yml readable inside the
 container.

Container runs as non-root; mode 0640 owned by westfarn caused
PermissionError on /etc/searxng/settings.yml and a restart loop.
Also lengthen the default secret_key to >= 32 chars.
---
 roles/searxng/defaults/main.yml | 3 ++-
 roles/searxng/tasks/main.yml    | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/roles/searxng/defaults/main.yml b/roles/searxng/defaults/main.yml
index 774e6ca..96282b9 100644
--- a/roles/searxng/defaults/main.yml
+++ b/roles/searxng/defaults/main.yml
@@ -13,7 +13,8 @@ searxng_container_port: 8080
 searxng_base_url: "http://{{ ansible_host }}:{{ searxng_host_port }}/"
 
 # Override via host_vars or vault; must be stable across restarts.
-searxng_secret_key: "CHANGE_ME_SEARXNG_SECRET"
+# SearxNG expects a long random string (use >= 32 chars).
+searxng_secret_key: "change-me-searxng-secret-key-32chars"
 
 # LAN CIDR allowed to hit the JSON API (same pattern as observability).
 searxng_ufw_from: "{{ ufw_ssh_allowed_network }}"
diff --git a/roles/searxng/tasks/main.yml b/roles/searxng/tasks/main.yml
index 83b2460..45a8753 100644
--- a/roles/searxng/tasks/main.yml
+++ b/roles/searxng/tasks/main.yml
@@ -8,7 +8,7 @@
     state: directory
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0750"
+    mode: "0755"
 
 - name: searxng | settings.yml
   ansible.builtin.template:
@@ -16,7 +16,8 @@
     dest: "{{ searxng_dir }}/settings.yml"
     owner: "{{ admin_user }}"
     group: "{{ admin_user }}"
-    mode: "0640"
+    # Container runs as non-root searxng UID — must be world-readable (#10).
+    mode: "0644"
   register: _searxng_settings
 
 - name: searxng | compose file