chat_backend#62 / PR #65 makes SearxNG the primary web-search provider for grounded chat answers (SEARCH_PROVIDER=searxng). Chat backends on adama / roslin / ai-server-4080 must reach a LAN-stable JSON API.
Ollama already lives on ai-server-4080 (10.0.0.128:11434). SearxNG should sit beside it — same host, same LAN firewall pattern — not on adama/roslin and not as a public NPM upstream.
Port note
Do not use host port 8080. On ai-server-4080, dta_webapp prod already binds 8080 (host_vars/ai-server-4080.yml). Use 8088 for SearxNG.
chat_backend secrets must then be:
SEARXNG_BASE_URL=http://10.0.0.128:8088
(not :8080 as a naive default).
Proposed implementation
Mirror the observability role pattern:
Add roles/searxng/ with:
defaults/main.yml — image, dir ({{ apps_base_dir }}/searxng), host port 8088, LAN CIDR
Ollama on same host (not Ansible-managed today; same LAN reachability model)
## Why
[chat_backend#62](https://git.aimloperations.com/ai_ml_operations/chat_backend/issues/62) / [PR #65](https://git.aimloperations.com/ai_ml_operations/chat_backend/pulls/65) makes **SearxNG** the primary web-search provider for grounded chat answers (`SEARCH_PROVIDER=searxng`). Chat backends on adama / roslin / ai-server-4080 must reach a LAN-stable JSON API.
Ollama already lives on **ai-server-4080** (`10.0.0.128:11434`). SearxNG should sit beside it — same host, same LAN firewall pattern — not on adama/roslin and not as a public NPM upstream.
## Port note
**Do not use host port 8080.** On ai-server-4080, `dta_webapp` prod already binds `8080` (`host_vars/ai-server-4080.yml`). Use **8088** for SearxNG.
chat_backend secrets must then be:
```text
SEARXNG_BASE_URL=http://10.0.0.128:8088
```
(not `:8080` as a naive default).
## Proposed implementation
Mirror the `observability` role pattern:
1. Add `roles/searxng/` with:
- `defaults/main.yml` — image, dir (`{{ apps_base_dir }}/searxng`), host port `8088`, LAN CIDR
- `templates/docker-compose.yml.j2` — `searxng/searxng:latest`, publish `8088:8080`
- `templates/settings.yml.j2` — enable `search.formats: [html, json]` (JSON required by chat_backend)
- `tasks/main.yml` — dirs, templates, UFW allow `8088/tcp` from `10.0.0.0/24`, `docker compose up -d`
2. Gate with `searxng_stack: true` in `inventory/host_vars/ai-server-4080.yml`.
3. Wire into `playbooks/site.yml` under the ai-server-4080 play (alongside observability).
4. Document in `IMPLEMENTATION.md` / `scripts/provision.sh` help text.
5. Call out the chat_backend secret update (`SEARXNG_BASE_URL=http://10.0.0.128:8088`).
## Acceptance criteria
- [ ] `./scripts/provision.sh ai-server-4080` (or targeted role run) brings up SearxNG on `10.0.0.128:8088`.
- [ ] UFW allows `10.0.0.0/24` → `8088/tcp` only (not world-open).
- [ ] `curl -sG 'http://10.0.0.128:8088/search' --data-urlencode 'q=test' -d 'format=json'` returns JSON from adama/roslin/ai-server-4080.
- [ ] Host port **8088** — no clash with dta_webapp `:8080` or chat_web_app `:8082/:8083`.
- [ ] Docs note chat_backend `SEARXNG_BASE_URL=http://10.0.0.128:8088`.
- [ ] Role is no-op on adama/roslin unless explicitly enabled.
## Related
- chat_backend#62 / PR #65 — grounded retrieval
- Ollama on same host (not Ansible-managed today; same LAN reachability model)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
chat_backend#62 / PR #65 makes SearxNG the primary web-search provider for grounded chat answers (
SEARCH_PROVIDER=searxng). Chat backends on adama / roslin / ai-server-4080 must reach a LAN-stable JSON API.Ollama already lives on ai-server-4080 (
10.0.0.128:11434). SearxNG should sit beside it — same host, same LAN firewall pattern — not on adama/roslin and not as a public NPM upstream.Port note
Do not use host port 8080. On ai-server-4080,
dta_webappprod already binds8080(host_vars/ai-server-4080.yml). Use 8088 for SearxNG.chat_backend secrets must then be:
(not
:8080as a naive default).Proposed implementation
Mirror the
observabilityrole pattern:roles/searxng/with:defaults/main.yml— image, dir ({{ apps_base_dir }}/searxng), host port8088, LAN CIDRtemplates/docker-compose.yml.j2—searxng/searxng:latest, publish8088:8080templates/settings.yml.j2— enablesearch.formats: [html, json](JSON required by chat_backend)tasks/main.yml— dirs, templates, UFW allow8088/tcpfrom10.0.0.0/24,docker compose up -dsearxng_stack: trueininventory/host_vars/ai-server-4080.yml.playbooks/site.ymlunder the ai-server-4080 play (alongside observability).IMPLEMENTATION.md/scripts/provision.shhelp text.SEARXNG_BASE_URL=http://10.0.0.128:8088).Acceptance criteria
./scripts/provision.sh ai-server-4080(or targeted role run) brings up SearxNG on10.0.0.128:8088.10.0.0.0/24→8088/tcponly (not world-open).curl -sG 'http://10.0.0.128:8088/search' --data-urlencode 'q=test' -d 'format=json'returns JSON from adama/roslin/ai-server-4080.:8080or chat_web_app:8082/:8083.SEARXNG_BASE_URL=http://10.0.0.128:8088.Related