---
# SearxNG for chat_backend grounded web search (#10).
# Hosted on ai-server-4080 only (next to Ollama). LAN-only — not NPM public.

searxng_dir: "{{ apps_base_dir }}/searxng"
searxng_image: "searxng/searxng:latest"

# Host port 8088 — 8080 is already dta_webapp prod on ai-server-4080.
searxng_host_port: 8088
searxng_container_port: 8080

# Public base URL as seen by chat_backend containers on the LAN.
searxng_base_url: "http://{{ ansible_host }}:{{ searxng_host_port }}/"

# Override via host_vars or vault; must be stable across restarts.
# SearxNG expects a long random string (use >= 32 chars).
searxng_secret_key: "change-me-searxng-secret-key-32chars"

# LAN CIDR allowed to hit the JSON API (same pattern as observability).
searxng_ufw_from: "{{ ufw_ssh_allowed_network }}"