# VPS Discovery Report

**Target Host:** `root@miguelpedro.xyz.br` (`dd.vps-kinghost.net`)  
**Discovery Date:** 2026-10-29  
**OS / Kernel:** Debian GNU/Linux 13 (trixie) v13.7 | Kernel `6.12.63+deb13-amd64` x86_64  
**Runtime Model:** Bare-metal / VM Systemd services (No Docker or Podman installed)

---

## 1. Architecture Overview

```
Internet (Ports 80/443)
   │
   ▼
[ Nginx Reverse Proxy & Web Server ] (/etc/nginx)
   ├── miguelpedro.xyz.br / www.miguelpedro.xyz.br ──► Static files (/var/www/html)
   ├── _ (default_server :80) ───────────────────────► Static files + /searxng sub-path
   ├── git.miguelpedro.xyz.br (:80 / :443)
   │      │
   │      ▼ (Unix Socket: /run/fcgiwrap.socket)
   │   [ fcgiwrap Daemon ] ──► /usr/lib/cgit/cgit.cgi (/etc/cgitrc)
   │                           Scans bare Git repos in /srv/git (user/group `git` 999:989)
   └── searx.miguelpedro.xyz.br (HTTPS :443)
          │
          ▼ (Unix Socket: /usr/local/searxng/run/socket)
       [ uWSGI Daemon ] (/etc/uwsgi/apps-enabled/searxng.ini)
          │  Runs as user/group `searxng` (UID/GID 988)
          │  Python venv: /usr/local/searxng/searx-pyenv
          │  App source:  /usr/local/searxng/searxng-src
          │  Settings:    /etc/searxng/settings.yml & limiter.toml
          ▼ (TCP: 127.0.0.1:6379)
       [ Valkey Server ] (/etc/valkey/valkey.conf)
```

---

## 2. Web Server (Nginx)

- **Service:** `nginx.service` (active, enabled)
- **Main Config:** `/etc/nginx/nginx.conf` (standard Debian config with `server_tokens off;` enabled)
- **Active Virtual Hosts (`/etc/nginx/sites-enabled/`):**
  1. **`default` (`-> /etc/nginx/sites-available/default`)**:
     - Port 80 `default_server` (`server_name _;`): serves `/var/www/html` and includes `/etc/nginx/default.d/*.conf`.
     - Port 443 SSL (`server_name www.miguelpedro.xyz.br miguelpedro.xyz.br;`): serves `/var/www/html` using Let's Encrypt certificate `miguelpedro.xyz.br`.
     - Port 80 redirect block for `miguelpedro.xyz.br` and `www.miguelpedro.xyz.br` (301 to HTTPS).
     - *Note:* `/etc/nginx/sites-available/default.bak` also exists as a backup prior to SearXNG setup.
  2. **`searxng.conf` (`-> /etc/nginx/sites-available/searxng.conf`)**:
     - Port 443 SSL (`server_name searx.miguelpedro.xyz.br;`):
       - Privacy logging: `access_log /dev/null;` and `error_log /dev/null;`
       - Security headers: `X-Frame-Options "SAMEORIGIN"`, `X-Content-Type-Options "nosniff"`, `Referrer-Policy "no-referrer"`, `Strict-Transport-Security "max-age=31536000; includeSubDomains"`.
       - Proxies `location /` via `uwsgi_pass unix:///usr/local/searxng/run/socket;` with `HTTP_HOST`, `HTTP_CONNECTION`, `HTTP_X_SCHEME`, `HTTP_X_REAL_IP`, and `HTTP_X_FORWARDED_FOR`.
     - Port 80 redirect block for `searx.miguelpedro.xyz.br` (301 to HTTPS).
  3. **`cgit.conf` (`-> /etc/nginx/sites-available/cgit.conf`)**:
     - Serves `git.miguelpedro.xyz.br`, mapping static assets `/cgit-css/*` to `/usr/share/cgit/` and passing CGI requests to `unix:/run/fcgiwrap.socket` (`/usr/lib/cgit/cgit.cgi`). Blocks `git-receive-pack` over HTTP (`403`) so pushes remain strictly over SSH. Automatically upgrades to HTTPS once `/etc/letsencrypt/live/git.miguelpedro.xyz.br/fullchain.pem` is provisioned.
  4. **`miguelpedro.xyz.br` (disabled stub in `/etc/nginx/sites-available/miguelpedro.xyz.br`)**:
     - Symlink removed from `/etc/nginx/sites-enabled/` via Ansible (`nginx_remove_unused_sites`).
- **Default App Includes (`/etc/nginx/default.d/`):**
  - `/etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf` (created by SearXNG's official installation script, exposing `location /searxng` on the default server block).

---

## 2b. cgit & Git Server (`git.miguelpedro.xyz.br`)

- **Packages:** `cgit`, `fcgiwrap`, `git`, `python3-pygments`, `python3-markdown`, `python3-docutils`
- **Services:** `fcgiwrap.socket` and `fcgiwrap.service` (active, enabled; socket `/run/fcgiwrap.socket`).
- **System User & Group:** `git` (`UID=999`, `GID=989`, home `/srv/git`, shell `/usr/bin/git-shell`). `www-data` is a member of the `git` group (`989`) to allow `cgit`/`fcgiwrap` read access, with `/var/www/.gitconfig` configuring `safe.directory = *`.
- **Repositories Root:** `/srv/git` (`02750` `git:git`)
  - `/srv/git/.ssh/authorized_keys` (`0600` `git:git`): Contains authorized SSH public keys.
  - `/srv/git/git-shell-commands/`: Custom `git-shell` helper commands (`init`, `list`, `no-interactive-login`) allowing remote creation of bare repositories via `ssh git@miguelpedro.xyz.br init <repo>.git "<description>"`.
- **Configuration:** `/etc/cgitrc` (enables `enable-http-clone=1`, syntax highlighting via Pygments, README rendering, and `scan-path=/srv/git`).

---

## 3. SearXNG, uWSGI & Valkey

SearXNG was installed using the official SearXNG installation script (`utils/searxng.sh`), running natively via `uwsgi` and backed by `valkey-server`.

### System User & Environment
- **User/Group:** `searxng` (`UID=988`, `GID=988`, home `/usr/local/searxng`, shell `/bin/bash`, member of `sudo` group).
- **Profile:** `/usr/local/searxng/.profile` automatically activates `/usr/local/searxng/searx-pyenv/bin/activate`.
- **Source Repository:** `/usr/local/searxng/searxng-src`
  - Git remote: `https://github.com/searxng/searxng` (`master` branch, commit `b5ed73fcb6c6bda5d4e8b13d1472aa3917f784dc`).
- **Virtualenv:** `/usr/local/searxng/searx-pyenv`

### SearXNG Configuration (`/etc/searxng/`)
- **`/etc/searxng/settings.yml`** (`0640`, `searxng:searxng`):
  - `use_default_settings: true`
  - `general`: `debug: false`, `instance_name: "SearXNG"`
  - `search`: `safe_search: 0`, `autocomplete: "duckduckgo"`, `formats: [html, json]`
  - `server`: `secret_key` (32-char hex), `limiter: true`, `image_proxy: true`, `base_url: https://searx.miguelpedro.xyz.br/`
  - `valkey`: `url: valkey://localhost:6379/0`
- **`/etc/searxng/limiter.toml`** (`0644`, `searxng:searxng`):
  - Configures `[botdetection]` with `ipv4_prefix = 32`, `ipv6_prefix = 48`, `trusted_proxies = ['127.0.0.0/8', '::1']`, and `pass_searxng_org = true`.

### Application Server (uWSGI)
- **Service:** `uwsgi.service` (SysV/LSB service via `/etc/init.d/uwsgi`, configured by `/etc/default/uwsgi`).
- **App Config:** `/etc/uwsgi/apps-enabled/searxng.ini -> /etc/uwsgi/apps-available/searxng.ini`
  - Runs as `uid = searxng`, `gid = searxng`
  - `chdir = /usr/local/searxng/searxng-src/searx`
  - `env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml`
  - `disable-logging = true`, `chmod-socket = 666`
  - `plugin = python3,http`, `workers = %k`, `threads = 4`, `offload-threads = %k`
  - `module = searx.webapp`
  - `virtualenv = /usr/local/searxng/searx-pyenv`
  - `pythonpath = /usr/local/searxng/searxng-src`
  - `socket = /usr/local/searxng/run/socket`

### Key-Value Store (Valkey)
- **Service:** `valkey-server.service` (active, enabled; aliased as `valkey.service`).
- **Config:** `/etc/valkey/valkey.conf` (bound to `127.0.0.1` and `-::1` on port `6379`, data dir `/var/lib/valkey`).

---

## 4. TLS/SSL & Firewall State

### TLS / Certbot
- **Packages:** `certbot`, `python3-certbot-nginx`
- **Timer:** `certbot.timer` (active, runs twice daily) and `/etc/cron.d/certbot`.
- **Certificates (`/etc/letsencrypt/live/`):**
  1. `miguelpedro.xyz.br` (Domains: `miguelpedro.xyz.br`, `www.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`)
  2. `searx.miguelpedro.xyz.br` (Domains: `searx.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`)
- **Shared Nginx TLS Configs:** `/etc/letsencrypt/options-ssl-nginx.conf` and `/etc/letsencrypt/ssl-dhparams.pem`.

### Firewall & Network
- **Listening Public Ports:**
  - `22/tcp` (IPv4 & IPv6) — OpenSSH (`sshd`)
  - `80/tcp` (IPv4 & IPv6) — Nginx HTTP
  - `443/tcp` (IPv4 & IPv6) — Nginx HTTPS
- **Listening Loopback Ports:**
  - `6379/tcp` (`127.0.0.1` & `::1`) — Valkey Server
- **Firewall State:**
  - `ufw` and `iptables` are **not installed**.
  - `nftables` (`/usr/sbin/nft`) is installed, with default empty tables in `/etc/nftables.conf`, and `nftables.service` is currently **disabled/inactive (dead)** (`nft list ruleset` is empty).

---

## 5. Complete Critical State Map

| Component | Critical Path on VPS | Purpose |
| :--- | :--- | :--- |
| **Nginx Core** | `/etc/nginx/nginx.conf` | Global Nginx settings (`server_tokens off`, TLS 1.2/1.3) |
| **Nginx VHosts** | `/etc/nginx/sites-available/default`<br>`/etc/nginx/sites-available/searxng.conf`<br>`/etc/nginx/sites-available/cgit.conf` | Main domain vhost, SearXNG reverse proxy vhost, and cgit vhost |
| **cgit & Git Repos** | `/etc/cgitrc`<br>`/srv/git/`<br>`/srv/git/git-shell-commands/`<br>`/run/fcgiwrap.socket` | cgit configuration, bare Git repositories (`git:git`), `git-shell` helpers, and FastCGI socket |
| **Nginx App Snippet** | `/etc/nginx/default.apps-available/searxng.conf` | `/searxng` sub-path snippet symlinked in `/etc/nginx/default.d/` |
| **Web Root** | `/var/www/html/`<br>`/var/www/miguelpedro.xyz.br/html/` | Static web roots |
| **SearXNG Config** | `/etc/searxng/settings.yml`<br>`/etc/searxng/limiter.toml` | SearXNG instance settings, secret key, Valkey URL, and bot limiter |
| **SearXNG App & Venv** | `/usr/local/searxng/searxng-src/`<br>`/usr/local/searxng/searx-pyenv/`<br>`/usr/local/searxng/run/socket` | SearXNG git clone, Python virtualenv, and uWSGI Unix socket |
| **uWSGI Config** | `/etc/uwsgi/apps-available/searxng.ini`<br>`/etc/default/uwsgi` | uWSGI worker configuration for SearXNG |
| **Valkey Config** | `/etc/valkey/valkey.conf`<br>`/var/lib/valkey/` | Local Redis-compatible store used by SearXNG limiter |
| **TLS Certificates** | `/etc/letsencrypt/live/*`<br>`/etc/letsencrypt/renewal/*.conf`<br>`/etc/letsencrypt/options-ssl-nginx.conf` | Certbot ECDSA certificates and renewal definitions |
| **Firewall** | `/etc/nftables.conf` | Nftables ruleset (currently inactive) |