Deploy SearxNG on ai-server-4080 for chat_backend grounded search (#10).

Add roles/searxng (compose + JSON-enabled settings), gate with searxng_stack on ai-server-4080, open UFW 8088/tcp from the LAN. Port 8088 avoids the dta_webapp :8080 clash; chat_backend must use SEARXNG_BASE_URL=http://10.0.0.128:8088.
2026-08-02 13:23:22 -05:00
parent 92afbc6e00
commit f1f96e49b1
8 changed files with 161 additions and 5 deletions
@@ -0,0 +1,19 @@
+---
+# SearxNG for chat_backend grounded web search (#10).
+# Hosted on ai-server-4080 only (next to Ollama). LAN-only — not NPM public.
+
+searxng_dir: "{{ apps_base_dir }}/searxng"
+searxng_image: "searxng/searxng:latest"
+
+# Host port 8088 — 8080 is already dta_webapp prod on ai-server-4080.
+searxng_host_port: 8088
+searxng_container_port: 8080
+
+# Public base URL as seen by chat_backend containers on the LAN.
+searxng_base_url: "http://{{ ansible_host }}:{{ searxng_host_port }}/"
+
+# Override via host_vars or vault; must be stable across restarts.
+searxng_secret_key: "CHANGE_ME_SEARXNG_SECRET"
+
+# LAN CIDR allowed to hit the JSON API (same pattern as observability).
+searxng_ufw_from: "{{ ufw_ssh_allowed_network }}"