feat: Add SearXNG module and update infrastructure

- Introduced a new SearXNG module with configuration for Kubernetes deployment, service, and ingress.
- Updated existing Terraform app modules to include SearXNG in both dev-01 and prod-01 environments.
- Added necessary variables and secrets for SearXNG in the respective Terraform files.
- Updated Dockerfiles for llama.cpp and ollama to use latest versions.
- Enhanced security and hardening defaults in Kubernetes deployments.
- Improved documentation for Copilot instructions and Terraform workflows.

terraform/apps/dev-01/apps.tf

@@ -5,7 +5,7 @@ module "open-webui" {
   fqdn              = local.open_webui_fqdn
   ollama_proxy      = local.ollama_proxy
   secret_key        = var.webui_secret_key
-  tag               = "0.6-slim"
+  tag               = "v0.9.2-slim"
   log_level         = local.open_webui_log_level
 }
 
@@ -82,3 +82,13 @@ module "mstream" {
   music_folder      = local.mstream_music_folder
   fqdn              = local.mstream_fqdn
 }
+
+module "searxng" {
+  source = "../../modules/apps/searxng"
+
+  persistent_folder = local.searxng_folder
+  fqdn              = local.searxng_fqdn
+  issuer            = local.searxng_issuer
+  tag               = "2026.5.2-aefc3c316"
+  secret_key        = var.searxng_secret_key
+}

terraform/apps/dev-01/config.tf

@@ -111,6 +111,11 @@ locals {
           name    = "music"
           type    = "CNAME"
           content = "dev-01.${local.lab_domain}."
+        },
+        {
+          name    = "search"
+          type    = "CNAME"
+          content = "dev-01.${local.lab_domain}."
         }
       ]
     }
@@ -234,6 +239,11 @@ locals {
   # mstream
   mstream_music_folder = "/mnt/storage/Music"
   mstream_fqdn         = "music.${local.lab_domain}"
+
+  # searxng
+  searxng_folder = "/mnt/md0/searxng"
+  searxng_fqdn   = "search.${local.lab_domain}"
+  searxng_issuer = "letsencrypt-prod"
 }
 
 data "terraform_remote_state" "scaleway" {

terraform/apps/dev-01/provider.tf

@@ -16,5 +16,8 @@ provider "kubernetes" {
   config_path    = "~/.kube/config"
   config_context = "microk8s-dev-01"
   insecure       = true
+  ignore_annotations = [
+    "kubectl.kubernetes.io.*",
+  ]
 }
 

terraform/apps/dev-01/secrets.tf

@@ -27,3 +27,9 @@ variable "webui_secret_key" {
   type        = string
   sensitive   = true
 }
+
+variable "searxng_secret_key" {
+  description = "The secret key for SearXNG"
+  type        = string
+  sensitive   = true
+}

terraform/apps/dev-01/sectool.env

@@ -6,3 +6,4 @@ TF_VAR_nextcloud_admin_password=$NEXTCLOUD_ADMIN_PASSWORD
 TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
 TF_VAR_telegram_bot_token=$TELEGRAM_BOT_TOKEN
 TF_VAR_webui_secret_key=$WEBUI_SECRET_KEY
+TF_VAR_searxng_secret_key=$SEARXNG_SECRET_KEY

terraform/apps/prod-01/apps.tf

@@ -82,7 +82,7 @@ module "gitea" {
     mail_from            = "gitea@${local.primary_domain}"
     no_reply_address     = "no-reply@${local.primary_domain}"
     smtp_user            = var.scaleway_project_id
-    db_password          = var.gitea_mysql_password
+    db_passwd            = var.gitea_mysql_password
     smtp_host            = local.scaleway_smtp_host
     smtp_port            = local.scaleway_smtp_port
     smtp_user            = var.scaleway_project_id

terraform/apps/prod-01/resources/alexpires.me.conf

@@ -1,7 +1,7 @@
 resolver kube-dns.kube-system.svc.cluster.local valid=10s;
 
 location ^~ /api/ssh_locker/ {
-    rewrite ^/api/ssh_locker/(.*)$ /$1 break;
+    rewrite ^/api/ssh_locker/(?<path>.*)$ /$path break;
     proxy_pass https://backend.ssh-locker-web.svc.cluster.local;
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;

terraform/modules/apps/open-webui/variables.tf

@@ -11,7 +11,7 @@ variable "fqdn" {
 variable "tag" {
   description = "The version of app to install"
   type        = string
-  default     = "main"
+  default     = "v0.8.12"
 }
 
 variable "issuer" {
@@ -32,7 +32,6 @@ variable "ollama_proxy" {
   default = {
     enabled = false
   }
-
 }
 
 variable "secret_key" {

terraform/modules/apps/searxng/config.tf

@@ -0,0 +1,6 @@
+locals {
+  app_folder = var.persistent_folder
+
+  app_version = var.tag
+  app_fqdn    = var.fqdn
+}

terraform/modules/apps/searxng/ingress.tf

@@ -0,0 +1,39 @@
+resource "kubernetes_ingress_v1" "searxng" {
+  metadata {
+    name      = "ingress"
+    namespace = kubernetes_namespace.searxng.metadata[0].name
+
+    annotations = {
+      "kubernetes.io/ingress.class"              = "public"
+      "cert-manager.io/cluster-issuer"           = var.issuer
+      "kubernetes.io/tls-acme"                   = "true"
+      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
+    }
+  }
+
+  spec {
+    dynamic "tls" {
+      for_each = var.tls_enabled ? [1] : []
+      content {
+        hosts       = [var.fqdn]
+        secret_name = "searxng-tls"
+      }
+    }
+
+    rule {
+      host = var.fqdn
+      http {
+        path {
+          backend {
+            service {
+              name = kubernetes_service.searxng.metadata[0].name
+              port {
+                number = 8080
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

terraform/modules/apps/searxng/main.tf

@@ -0,0 +1,191 @@
+resource "kubernetes_namespace" "searxng" {
+  metadata {
+    name = "searxng"
+  }
+}
+
+resource "kubernetes_service_account" "searxng" {
+
+  metadata {
+    name      = "searxng-sa"
+    namespace = kubernetes_namespace.searxng.metadata[0].name
+  }
+
+  automount_service_account_token = false
+}
+
+resource "kubernetes_config_map" "searxng_config" {
+  metadata {
+    name      = "searxng-config"
+    namespace = kubernetes_namespace.searxng.metadata[0].name
+  }
+
+  data = {
+    BASE_URL     = "https://${local.app_fqdn}/"
+    GRANIAN_HOST = "0.0.0.0"
+  }
+}
+
+resource "kubernetes_secret" "searxng_secrets" {
+  metadata {
+    name      = "searxng-keys"
+    namespace = kubernetes_namespace.searxng.metadata[0].name
+  }
+
+  data = {
+    SEARXNG_SECRET = var.secret_key
+  }
+}
+
+resource "kubernetes_deployment" "searxng" {
+  metadata {
+    name      = "searxng"
+    namespace = kubernetes_namespace.searxng.metadata[0].name
+    labels = {
+      app = "searxng"
+    }
+  }
+
+  spec {
+    replicas = 1
+
+    selector {
+      match_labels = {
+        app = "searxng"
+      }
+    }
+
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          app = "searxng"
+        }
+      }
+
+      spec {
+        service_account_name            = kubernetes_service_account.searxng.metadata[0].name
+        automount_service_account_token = false
+
+        security_context {
+          run_as_non_root = true
+          run_as_user     = 977
+          run_as_group    = 977
+          fs_group        = 977
+
+          seccomp_profile {
+            type = "RuntimeDefault"
+          }
+        }
+
+        container {
+          name  = "searxng"
+          image = "searxng/searxng:${local.app_version}"
+
+          env_from {
+            config_map_ref {
+              name = kubernetes_config_map.searxng_config.metadata[0].name
+            }
+          }
+
+          env {
+            name = "SEARXNG_SECRET"
+            value_from {
+              secret_key_ref {
+                name = kubernetes_secret.searxng_secrets.metadata[0].name
+                key  = "SEARXNG_SECRET"
+              }
+            }
+          }
+
+          security_context {
+            allow_privilege_escalation = false
+            privileged                 = false
+
+            capabilities {
+              drop = ["ALL"]
+            }
+
+            read_only_root_filesystem = true
+          }
+
+          port {
+            name           = "http"
+            container_port = 8080
+            protocol       = "TCP"
+          }
+
+          liveness_probe {
+            http_get {
+              path = "/"
+              port = "http"
+            }
+            initial_delay_seconds = 30
+            period_seconds        = 15
+          }
+
+          readiness_probe {
+            http_get {
+              path = "/"
+              port = "http"
+            }
+            initial_delay_seconds = 10
+            period_seconds        = 10
+          }
+
+          volume_mount {
+            name       = "searxng-data"
+            mount_path = "/var/cache/searxng"
+          }
+
+          volume_mount {
+            name       = "searxng-tmp"
+            mount_path = "/tmp"
+          }
+        }
+
+        volume {
+          name = "searxng-data"
+          host_path {
+            path = local.app_folder
+          }
+        }
+
+        volume {
+          name = "searxng-tmp"
+          empty_dir {}
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "searxng" {
+  metadata {
+    name      = "searxng-service"
+    namespace = kubernetes_namespace.searxng.metadata[0].name
+  }
+
+  spec {
+    selector = {
+      app = "searxng"
+    }
+
+    port {
+      name        = "http"
+      port        = 8080
+      target_port = 8080
+    }
+
+    type = "ClusterIP"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      metadata[0].annotations
+    ]
+  }
+}

terraform/modules/apps/searxng/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/apps/searxng/variables.tf

@@ -0,0 +1,33 @@
+variable "persistent_folder" {
+  description = "The path to the persistent folder"
+  type        = string
+}
+
+variable "fqdn" {
+  description = "FQDN name of the service"
+  type        = string
+}
+
+variable "tag" {
+  description = "The version of searxng to install"
+  type        = string
+  default     = "latest"
+}
+
+variable "issuer" {
+  description = "The cert-manager cluster issuer"
+  type        = string
+  default     = "letsencrypt-prod"
+}
+
+variable "tls_enabled" {
+  description = "Enable TLS in ingress"
+  type        = bool
+  default     = true
+}
+
+variable "secret_key" {
+  description = "Secret key for SearXNG"
+  type        = string
+  sensitive   = true
+}