westfarn
6218f62408
Container runs as non-root; mode 0640 owned by westfarn caused PermissionError on /etc/searxng/settings.yml and a restart loop. Also lengthen the default secret_key to >= 32 chars.
66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
---
|
|
# SearxNG JSON search API for chat_backend grounded retrieval.
|
|
# Enabled on ai-server-4080 via searxng_stack: true (issue #10).
|
|
|
|
- name: searxng | ensure project directory
|
|
ansible.builtin.file:
|
|
path: "{{ searxng_dir }}"
|
|
state: directory
|
|
owner: "{{ admin_user }}"
|
|
group: "{{ admin_user }}"
|
|
mode: "0755"
|
|
|
|
- name: searxng | settings.yml
|
|
ansible.builtin.template:
|
|
src: settings.yml.j2
|
|
dest: "{{ searxng_dir }}/settings.yml"
|
|
owner: "{{ admin_user }}"
|
|
group: "{{ admin_user }}"
|
|
# Container runs as non-root searxng UID — must be world-readable (#10).
|
|
mode: "0644"
|
|
register: _searxng_settings
|
|
|
|
- name: searxng | compose file
|
|
ansible.builtin.template:
|
|
src: docker-compose.yml.j2
|
|
dest: "{{ searxng_dir }}/docker-compose.yml"
|
|
owner: "{{ admin_user }}"
|
|
group: "{{ admin_user }}"
|
|
mode: "0644"
|
|
register: _searxng_compose
|
|
|
|
- name: searxng | allow JSON API from LAN
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ searxng_host_port }}"
|
|
proto: tcp
|
|
from_ip: "{{ searxng_ufw_from }}"
|
|
comment: SearxNG for chat_backend grounded search
|
|
|
|
- name: searxng | start stack
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
docker compose up -d --remove-orphans
|
|
{{ '--force-recreate' if (
|
|
_searxng_compose is changed
|
|
or _searxng_settings is changed
|
|
) else '' }}
|
|
chdir: "{{ searxng_dir }}"
|
|
become: true
|
|
become_user: "{{ admin_user }}"
|
|
register: _searxng_up
|
|
changed_when: >-
|
|
_searxng_up.rc == 0 and (
|
|
'Started' in (_searxng_up.stdout | default(''))
|
|
or 'Recreated' in (_searxng_up.stdout | default(''))
|
|
or 'Created' in (_searxng_up.stdout | default(''))
|
|
or _searxng_compose is changed
|
|
or _searxng_settings is changed
|
|
)
|
|
failed_when: _searxng_up.rc != 0
|
|
|
|
- name: searxng | show compose failure output
|
|
ansible.builtin.debug:
|
|
msg: "{{ _searxng_up.stderr_lines | default(_searxng_up.stdout_lines) }}"
|
|
when: _searxng_up is failed
|