diff options
Diffstat (limited to 'DISCOVERY_REPORT.md')
| -rw-r--r-- | DISCOVERY_REPORT.md | 132 |
1 files changed, 132 insertions, 0 deletions
diff --git a/DISCOVERY_REPORT.md b/DISCOVERY_REPORT.md new file mode 100644 index 0000000..ab45750 --- /dev/null +++ b/DISCOVERY_REPORT.md @@ -0,0 +1,132 @@ +# VPS Discovery Report + +**Target Host:** `root@miguelpedro.xyz.br` (`dd.vps-kinghost.net`) +**Discovery Date:** 2026-10-29 +**OS / Kernel:** Debian GNU/Linux 13 (trixie) v13.7 | Kernel `6.12.63+deb13-amd64` x86_64 +**Runtime Model:** Bare-metal / VM Systemd services (No Docker or Podman installed) + +--- + +## 1. Architecture Overview + +``` +Internet (Ports 80/443) + │ + ▼ +[ Nginx Reverse Proxy & Web Server ] (/etc/nginx) + ├── miguelpedro.xyz.br / www.miguelpedro.xyz.br ──► Static files (/var/www/html) + ├── _ (default_server :80) ───────────────────────► Static files + /searxng sub-path + └── searx.miguelpedro.xyz.br (HTTPS :443) + │ + ▼ (Unix Socket: /usr/local/searxng/run/socket) + [ uWSGI Daemon ] (/etc/uwsgi/apps-enabled/searxng.ini) + │ Runs as user/group `searxng` (UID/GID 988) + │ Python venv: /usr/local/searxng/searx-pyenv + │ App source: /usr/local/searxng/searxng-src + │ Settings: /etc/searxng/settings.yml & limiter.toml + ▼ (TCP: 127.0.0.1:6379) + [ Valkey Server ] (/etc/valkey/valkey.conf) +``` + +--- + +## 2. Web Server (Nginx) + +- **Service:** `nginx.service` (active, enabled) +- **Main Config:** `/etc/nginx/nginx.conf` (standard Debian config with `server_tokens off;` enabled) +- **Active Virtual Hosts (`/etc/nginx/sites-enabled/`):** + 1. **`default` (`-> /etc/nginx/sites-available/default`)**: + - Port 80 `default_server` (`server_name _;`): serves `/var/www/html` and includes `/etc/nginx/default.d/*.conf`. + - Port 443 SSL (`server_name www.miguelpedro.xyz.br miguelpedro.xyz.br;`): serves `/var/www/html` using Let's Encrypt certificate `miguelpedro.xyz.br`. + - Port 80 redirect block for `miguelpedro.xyz.br` and `www.miguelpedro.xyz.br` (301 to HTTPS). + - *Note:* `/etc/nginx/sites-available/default.bak` also exists as a backup prior to SearXNG setup. + 2. **`searxng.conf` (`-> /etc/nginx/sites-available/searxng.conf`)**: + - Port 443 SSL (`server_name searx.miguelpedro.xyz.br;`): + - Privacy logging: `access_log /dev/null;` and `error_log /dev/null;` + - Security headers: `X-Frame-Options "SAMEORIGIN"`, `X-Content-Type-Options "nosniff"`, `Referrer-Policy "no-referrer"`, `Strict-Transport-Security "max-age=31536000; includeSubDomains"`. + - Proxies `location /` via `uwsgi_pass unix:///usr/local/searxng/run/socket;` with `HTTP_HOST`, `HTTP_CONNECTION`, `HTTP_X_SCHEME`, `HTTP_X_REAL_IP`, and `HTTP_X_FORWARDED_FOR`. + - Port 80 redirect block for `searx.miguelpedro.xyz.br` (301 to HTTPS). + 3. **`miguelpedro.xyz.br` (`-> /etc/nginx/sites-available/miguelpedro.xyz.br`)**: + - Port 80 stub with `server_name example.com www.example.com;` pointing to `/var/www/miguelpedro.xyz.br/html` (currently an empty directory, while the active `miguelpedro.xyz.br` site is served from `sites-available/default`). +- **Default App Includes (`/etc/nginx/default.d/`):** + - `/etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf` (created by SearXNG's official installation script, exposing `location /searxng` on the default server block). + +--- + +## 3. SearXNG, uWSGI & Valkey + +SearXNG was installed using the official SearXNG installation script (`utils/searxng.sh`), running natively via `uwsgi` and backed by `valkey-server`. + +### System User & Environment +- **User/Group:** `searxng` (`UID=988`, `GID=988`, home `/usr/local/searxng`, shell `/bin/bash`, member of `sudo` group). +- **Profile:** `/usr/local/searxng/.profile` automatically activates `/usr/local/searxng/searx-pyenv/bin/activate`. +- **Source Repository:** `/usr/local/searxng/searxng-src` + - Git remote: `https://github.com/searxng/searxng` (`master` branch, commit `b5ed73fcb6c6bda5d4e8b13d1472aa3917f784dc`). +- **Virtualenv:** `/usr/local/searxng/searx-pyenv` + +### SearXNG Configuration (`/etc/searxng/`) +- **`/etc/searxng/settings.yml`** (`0640`, `searxng:searxng`): + - `use_default_settings: true` + - `general`: `debug: false`, `instance_name: "SearXNG"` + - `search`: `safe_search: 0`, `autocomplete: "duckduckgo"`, `formats: [html, json]` + - `server`: `secret_key` (32-char hex), `limiter: true`, `image_proxy: true`, `base_url: https://searx.miguelpedro.xyz.br/` + - `valkey`: `url: valkey://localhost:6379/0` +- **`/etc/searxng/limiter.toml`** (`0644`, `searxng:searxng`): + - Configures `[botdetection]` with `ipv4_prefix = 32`, `ipv6_prefix = 48`, `trusted_proxies = ['127.0.0.0/8', '::1']`, and `pass_searxng_org = true`. + +### Application Server (uWSGI) +- **Service:** `uwsgi.service` (SysV/LSB service via `/etc/init.d/uwsgi`, configured by `/etc/default/uwsgi`). +- **App Config:** `/etc/uwsgi/apps-enabled/searxng.ini -> /etc/uwsgi/apps-available/searxng.ini` + - Runs as `uid = searxng`, `gid = searxng` + - `chdir = /usr/local/searxng/searxng-src/searx` + - `env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml` + - `disable-logging = true`, `chmod-socket = 666` + - `plugin = python3,http`, `workers = %k`, `threads = 4`, `offload-threads = %k` + - `module = searx.webapp` + - `virtualenv = /usr/local/searxng/searx-pyenv` + - `pythonpath = /usr/local/searxng/searxng-src` + - `socket = /usr/local/searxng/run/socket` + +### Key-Value Store (Valkey) +- **Service:** `valkey-server.service` (active, enabled; aliased as `valkey.service`). +- **Config:** `/etc/valkey/valkey.conf` (bound to `127.0.0.1` and `-::1` on port `6379`, data dir `/var/lib/valkey`). + +--- + +## 4. TLS/SSL & Firewall State + +### TLS / Certbot +- **Packages:** `certbot`, `python3-certbot-nginx` +- **Timer:** `certbot.timer` (active, runs twice daily) and `/etc/cron.d/certbot`. +- **Certificates (`/etc/letsencrypt/live/`):** + 1. `miguelpedro.xyz.br` (Domains: `miguelpedro.xyz.br`, `www.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`) + 2. `searx.miguelpedro.xyz.br` (Domains: `searx.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`) +- **Shared Nginx TLS Configs:** `/etc/letsencrypt/options-ssl-nginx.conf` and `/etc/letsencrypt/ssl-dhparams.pem`. + +### Firewall & Network +- **Listening Public Ports:** + - `22/tcp` (IPv4 & IPv6) — OpenSSH (`sshd`) + - `80/tcp` (IPv4 & IPv6) — Nginx HTTP + - `443/tcp` (IPv4 & IPv6) — Nginx HTTPS +- **Listening Loopback Ports:** + - `6379/tcp` (`127.0.0.1` & `::1`) — Valkey Server +- **Firewall State:** + - `ufw` and `iptables` are **not installed**. + - `nftables` (`/usr/sbin/nft`) is installed, with default empty tables in `/etc/nftables.conf`, and `nftables.service` is currently **disabled/inactive (dead)** (`nft list ruleset` is empty). + +--- + +## 5. Complete Critical State Map + +| Component | Critical Path on VPS | Purpose | +| :--- | :--- | :--- | +| **Nginx Core** | `/etc/nginx/nginx.conf` | Global Nginx settings (`server_tokens off`, TLS 1.2/1.3) | +| **Nginx VHosts** | `/etc/nginx/sites-available/default`<br>`/etc/nginx/sites-available/searxng.conf`<br>`/etc/nginx/sites-available/miguelpedro.xyz.br` | Main domain vhost, SearXNG reverse proxy vhost, and stub config | +| **Nginx App Snippet** | `/etc/nginx/default.apps-available/searxng.conf` | `/searxng` sub-path snippet symlinked in `/etc/nginx/default.d/` | +| **Web Root** | `/var/www/html/`<br>`/var/www/miguelpedro.xyz.br/html/` | Static web roots | +| **SearXNG Config** | `/etc/searxng/settings.yml`<br>`/etc/searxng/limiter.toml` | SearXNG instance settings, secret key, Valkey URL, and bot limiter | +| **SearXNG App & Venv** | `/usr/local/searxng/searxng-src/`<br>`/usr/local/searxng/searx-pyenv/`<br>`/usr/local/searxng/run/socket` | SearXNG git clone, Python virtualenv, and uWSGI Unix socket | +| **uWSGI Config** | `/etc/uwsgi/apps-available/searxng.ini`<br>`/etc/default/uwsgi` | uWSGI worker configuration for SearXNG | +| **Valkey Config** | `/etc/valkey/valkey.conf`<br>`/var/lib/valkey/` | Local Redis-compatible store used by SearXNG limiter | +| **TLS Certificates** | `/etc/letsencrypt/live/*`<br>`/etc/letsencrypt/renewal/*.conf`<br>`/etc/letsencrypt/options-ssl-nginx.conf` | Certbot ECDSA certificates and renewal definitions | +| **Firewall** | `/etc/nftables.conf` | Nftables ruleset (currently inactive) | |