From 4b7379914a1865f07b2c54252234cc90158fc253 Mon Sep 17 00:00:00 2001 From: Miguel Dalberto Pedro Date: Thu, 29 Oct 2026 12:48:06 -0300 Subject: feat(iac): establish Ansible baseline for Nginx, SearXNG, Valkey, and Certbot - Reverse-engineer live Debian 13 (trixie) VPS state at miguelpedro.xyz.br - Add modular Ansible roles: common, certbot, valkey, searxng, and nginx - Encrypt SearXNG secret_key using ansible-vault in group_vars/all/vault.yml - Cleanly remove unused example.com Nginx stub symlink (sites-enabled/miguelpedro.xyz.br) - Scaffold cgit + fcgiwrap role (cgit_enabled: false) for upcoming deployment - Add DISCOVERY_REPORT.md, COMMAND_LOG.md, README.md, and AGENT_INSTRUCTIONS.md with Self-Updating Protocol --- roles/searxng/templates/limiter.toml.j2 | 49 +++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 roles/searxng/templates/limiter.toml.j2 (limited to 'roles/searxng/templates/limiter.toml.j2') diff --git a/roles/searxng/templates/limiter.toml.j2 b/roles/searxng/templates/limiter.toml.j2 new file mode 100644 index 0000000..0b40bf8 --- /dev/null +++ b/roles/searxng/templates/limiter.toml.j2 @@ -0,0 +1,49 @@ +[botdetection] + +# The prefix defines the number of leading bits in an address that are compared +# to determine whether or not an address is part of a (client) network. + +ipv4_prefix = 32 +ipv6_prefix = 48 + +# If the request IP is in trusted_proxies list, the client IP address is +# extracted from the X-Forwarded-For and X-Real-IP headers. This should be +# used if SearXNG is behind a reverse proxy or load balancer. + +trusted_proxies = [ + '127.0.0.0/8', + '::1', + # '192.168.0.0/16', + # '172.16.0.0/12', + # '10.0.0.0/8', + # 'fd00::/8', +] + +[botdetection.ip_limit] + +# To get unlimited access in a local network, by default link-local addresses +# (networks) are not monitored by the ip_limit +filter_link_local = false + +# activate link_token method in the ip_limit method +link_token = false + +[botdetection.ip_lists] + +# In the limiter, the ip_lists method has priority over all other methods -> if +# an IP is in the pass_ip list, it has unrestricted access and it is also not +# checked if e.g. the "user agent" suggests a bot (e.g. curl). + +block_ip = [ + # '93.184.216.34', # IPv4 of example.org + # '257.1.1.1', # invalid IP --> will be ignored, logged in ERROR class +] + +pass_ip = [ + # '192.168.0.0/16', # IPv4 private network + # 'fe80::/10' # IPv6 linklocal / wins over botdetection.ip_limit.filter_link_local +] + +# Activate passlist of (hardcoded) IPs from the SearXNG organization, +# e.g. `check.searx.space`. +pass_searxng_org = true -- cgit v1.2.3