SearXNG sidecar in compose #77

2026-10-06T07:01:56-04:00

dev_agent commented

2026-10-06 07:01:56 -04:00

Maestro task: 641f468b-68e9-42e2-b640-3199984cf75c (Feature 10 - Recipe Grounding and Photos). Resumes after Feature 07 landed deploy/compose.yaml in dev.

Done-condition

deploy/searxng/settings.yml enables json output, disables the public limiter/bot detection for internal use, takes a generated secret_key via env, and limits engines to general web search engines; deploy/compose.yaml adds a searxng service (pinned image digest, internal network only, no published port, healthcheck) and sets MEALQUEST_SEARXNG_URL=http://searxng:8080 for mealquest; deploy/compose.dev.yaml exposes it on localhost for development. Evidence: from inside the mealquest container the SearXNG JSON query returns >=5 results and the port is not reachable from the host's LAN.

What this adds

deploy/searxng/settings.yml (json on, limiter/public_instance off, engines limited to general web engines, no secret in the file).
deploy/compose.yaml: a searxng service pinned to searxng/searxng:2026.10.4-d48c4b555@sha256:76b0bf28... on the internal mealquest network only, no published port, healthcheck /healthz, read-only root fs, no caps, uid 977, restart:no; MEALQUEST_SEARXNG_URL set for mealquest.
deploy/compose.dev.yaml: publishes searxng on 127.0.0.1:8888 only.
Secret: deploy/secrets/searxng.env (SEARXNG_SECRET, git-ignored, 0600); RUNBOOK.md and .env.example updated.

Evidence (on 10.60.1.14)

From inside the mealquest container: wget 'http://searxng:8080/search?q=chicken+tikka+masala+recipe&format=json' -> 11,575 bytes, 17 results (first five include indianhealthyrecipes, allrecipes, bonappetit, cafedelites, foodnetwork).
No published port: docker compose port searxng 8080 -> :0, bindings {}, docker ps shows 8080/tcp with no host binding; curl to 10.60.1.14:8888 refused from another LAN host; the host's only :8080 listener is NestQuest's.
App /health 200 (LAN and public); NestQuest/Seafile/Plex/OnlyOffice untouched; DOCKER-USER rules unchanged.

Notes

Four of six engines were blocked from the host (Brave, DuckDuckGo, Google, Startpage); all 17 results came from Bing and Mojeek. Meets the bar but rests on two engines; SearXNG retries suspended engines.
SearXNG logs a missing limiter.toml warning and an X-Forwarded-For notice; harmless with the limiter off.

Maestro task: 641f468b-68e9-42e2-b640-3199984cf75c (Feature 10 - Recipe Grounding and Photos). Resumes after Feature 07 landed deploy/compose.yaml in dev. ## Done-condition deploy/searxng/settings.yml enables json output, disables the public limiter/bot detection for internal use, takes a generated secret_key via env, and limits engines to general web search engines; deploy/compose.yaml adds a searxng service (pinned image digest, internal network only, no published port, healthcheck) and sets MEALQUEST_SEARXNG_URL=http://searxng:8080 for mealquest; deploy/compose.dev.yaml exposes it on localhost for development. Evidence: from inside the mealquest container the SearXNG JSON query returns >=5 results and the port is not reachable from the host's LAN. ## What this adds - deploy/searxng/settings.yml (json on, limiter/public_instance off, engines limited to general web engines, no secret in the file). - deploy/compose.yaml: a searxng service pinned to searxng/searxng:2026.10.4-d48c4b555@sha256:76b0bf28... on the internal mealquest network only, no published port, healthcheck /healthz, read-only root fs, no caps, uid 977, restart:no; MEALQUEST_SEARXNG_URL set for mealquest. - deploy/compose.dev.yaml: publishes searxng on 127.0.0.1:8888 only. - Secret: deploy/secrets/searxng.env (SEARXNG_SECRET, git-ignored, 0600); RUNBOOK.md and .env.example updated. ## Evidence (on 10.60.1.14) - From inside the mealquest container: wget 'http://searxng:8080/search?q=chicken+tikka+masala+recipe&format=json' -> 11,575 bytes, 17 results (first five include indianhealthyrecipes, allrecipes, bonappetit, cafedelites, foodnetwork). - No published port: `docker compose port searxng 8080` -> `:0`, bindings {}, docker ps shows 8080/tcp with no host binding; curl to 10.60.1.14:8888 refused from another LAN host; the host's only :8080 listener is NestQuest's. - App /health 200 (LAN and public); NestQuest/Seafile/Plex/OnlyOffice untouched; DOCKER-USER rules unchanged. ## Notes - Four of six engines were blocked from the host (Brave, DuckDuckGo, Google, Startpage); all 17 results came from Bing and Mojeek. Meets the bar but rests on two engines; SearXNG retries suspended engines. - SearXNG logs a missing limiter.toml warning and an X-Forwarded-For notice; harmless with the limiter off.

dev_agent added 1 commit 2026-10-06 07:01:57 -04:00

Add SearXNG recipe-search sidecar to the compose stack

CI / ci (push) Successful in 1m51s

Details

CI / ci (pull_request) Successful in 1m53s

Details

944299b455

deploy/searxng/settings.yml enables the json format, turns off the public
limiter and bot detection (internal use only) and keeps only general web
search engines; the secret key comes from SEARXNG_SECRET in the
git-ignored deploy/secrets/searxng.env. deploy/compose.yaml adds the
searxng service (digest-pinned image, mealquest network only, no
published port, healthcheck, read-only root) and sets
MEALQUEST_SEARXNG_URL=http://searxng:8080 for mealquest.
deploy/compose.dev.yaml publishes it on 127.0.0.1:8888 for development.
RUNBOOK and .env.example document the new secret and checks.

Task 641f468b-68e9-42e2-b640-3199984cf75c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

overseer added 1 commit 2026-10-06 07:01:57 -04:00

Add SearXNG recipe-search sidecar to the compose stack

CI / ci (push) Successful in 1m51s

Details

CI / ci (pull_request) Successful in 1m53s

Details

944299b455

deploy/searxng/settings.yml enables the json format, turns off the public
limiter and bot detection (internal use only) and keeps only general web
search engines; the secret key comes from SEARXNG_SECRET in the
git-ignored deploy/secrets/searxng.env. deploy/compose.yaml adds the
searxng service (digest-pinned image, mealquest network only, no
published port, healthcheck, read-only root) and sets
MEALQUEST_SEARXNG_URL=http://searxng:8080 for mealquest.
deploy/compose.dev.yaml publishes it on 127.0.0.1:8888 for development.
RUNBOOK and .env.example document the new secret and checks.

Task 641f468b-68e9-42e2-b640-3199984cf75c.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent requested changes

2026-10-06 07:04:32 -04:00

Dismissed

review_agent left a comment

Independent Codex gpt-6-sol review: CHANGES_REQUIRED for this exact commit.

overseer added 1 commit 2026-10-06 07:11:15 -04:00

Document how the app is connected to the SearXNG sidecar

CI / ci (push) Successful in 1m54s

Details

CI / ci (pull_request) Successful in 1m55s

Details

3972069e06

The service does not read MEALQUEST_SEARXNG_URL; the recipe-search
provider and base URL come from the recipe_search_settings row. The
runbook now gives the PATCH/GET/test steps to point the app at
http://searxng:8080, says the variable is planned, and records which
engines answered from this host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-10-06 07:13:23 -04:00

review_agent left a comment

Independent Codex gpt-6-sol review: APPROVED for this exact commit.

approver_agent merged commit 13512f97b8 into feature/cebed295-8c05-453b-807b-8078dcd8d250-recipe-grounding

2026-10-06 07:17:07 -04:00

dev_agent referenced this pull request

2026-10-06 07:17:57 -04:00

Feature 10: Recipe grounding and photos #78

dev_agent referenced this pull request

2026-10-06 07:29:52 -04:00

Promote dev to main: Feature 10 (recipe grounding and photos) #79