1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
# VPS Discovery Report
**Target Host:** `root@miguelpedro.xyz.br` (`dd.vps-kinghost.net`)
**Discovery Date:** 2026-10-29
**OS / Kernel:** Debian GNU/Linux 13 (trixie) v13.7 | Kernel `6.12.63+deb13-amd64` x86_64
**Runtime Model:** Bare-metal / VM Systemd services (No Docker or Podman installed)
---
## 1. Architecture Overview
```
Internet (Ports 80/443)
│
▼
[ Nginx Reverse Proxy & Web Server ] (/etc/nginx)
├── miguelpedro.xyz.br / www.miguelpedro.xyz.br ──► Static files (/var/www/html)
├── _ (default_server :80) ───────────────────────► Static files + /searxng sub-path
├── git.miguelpedro.xyz.br (:80 / :443)
│ │
│ ▼ (Unix Socket: /run/fcgiwrap.socket)
│ [ fcgiwrap Daemon ] ──► /usr/lib/cgit/cgit.cgi (/etc/cgitrc)
│ Scans bare Git repos in /srv/git (user/group `git` 999:989)
└── searx.miguelpedro.xyz.br (HTTPS :443)
│
▼ (Unix Socket: /usr/local/searxng/run/socket)
[ uWSGI Daemon ] (/etc/uwsgi/apps-enabled/searxng.ini)
│ Runs as user/group `searxng` (UID/GID 988)
│ Python venv: /usr/local/searxng/searx-pyenv
│ App source: /usr/local/searxng/searxng-src
│ Settings: /etc/searxng/settings.yml & limiter.toml
▼ (TCP: 127.0.0.1:6379)
[ Valkey Server ] (/etc/valkey/valkey.conf)
```
---
## 2. Web Server (Nginx)
- **Service:** `nginx.service` (active, enabled)
- **Main Config:** `/etc/nginx/nginx.conf` (standard Debian config with `server_tokens off;` enabled)
- **Active Virtual Hosts (`/etc/nginx/sites-enabled/`):**
1. **`default` (`-> /etc/nginx/sites-available/default`)**:
- Port 80 `default_server` (`server_name _;`): serves `/var/www/html` and includes `/etc/nginx/default.d/*.conf`.
- Port 443 SSL (`server_name www.miguelpedro.xyz.br miguelpedro.xyz.br;`): serves `/var/www/html` using Let's Encrypt certificate `miguelpedro.xyz.br`.
- Port 80 redirect block for `miguelpedro.xyz.br` and `www.miguelpedro.xyz.br` (301 to HTTPS).
- *Note:* `/etc/nginx/sites-available/default.bak` also exists as a backup prior to SearXNG setup.
2. **`searxng.conf` (`-> /etc/nginx/sites-available/searxng.conf`)**:
- Port 443 SSL (`server_name searx.miguelpedro.xyz.br;`):
- Privacy logging: `access_log /dev/null;` and `error_log /dev/null;`
- Security headers: `X-Frame-Options "SAMEORIGIN"`, `X-Content-Type-Options "nosniff"`, `Referrer-Policy "no-referrer"`, `Strict-Transport-Security "max-age=31536000; includeSubDomains"`.
- Proxies `location /` via `uwsgi_pass unix:///usr/local/searxng/run/socket;` with `HTTP_HOST`, `HTTP_CONNECTION`, `HTTP_X_SCHEME`, `HTTP_X_REAL_IP`, and `HTTP_X_FORWARDED_FOR`.
- Port 80 redirect block for `searx.miguelpedro.xyz.br` (301 to HTTPS).
3. **`cgit.conf` (`-> /etc/nginx/sites-available/cgit.conf`)**:
- Serves `git.miguelpedro.xyz.br`, mapping static assets `/cgit-css/*` to `/usr/share/cgit/` and passing CGI requests to `unix:/run/fcgiwrap.socket` (`/usr/lib/cgit/cgit.cgi`). Blocks `git-receive-pack` over HTTP (`403`) so pushes remain strictly over SSH. Automatically upgrades to HTTPS once `/etc/letsencrypt/live/git.miguelpedro.xyz.br/fullchain.pem` is provisioned.
4. **`miguelpedro.xyz.br` (disabled stub in `/etc/nginx/sites-available/miguelpedro.xyz.br`)**:
- Symlink removed from `/etc/nginx/sites-enabled/` via Ansible (`nginx_remove_unused_sites`).
- **Default App Includes (`/etc/nginx/default.d/`):**
- `/etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf` (created by SearXNG's official installation script, exposing `location /searxng` on the default server block).
---
## 2b. cgit & Git Server (`git.miguelpedro.xyz.br`)
- **Packages:** `cgit`, `fcgiwrap`, `git`, `python3-pygments`, `python3-markdown`, `python3-docutils`
- **Services:** `fcgiwrap.socket` and `fcgiwrap.service` (active, enabled; socket `/run/fcgiwrap.socket`).
- **System User & Group:** `git` (`UID=999`, `GID=989`, home `/srv/git`, shell `/usr/bin/git-shell`). `www-data` is a member of the `git` group (`989`) to allow `cgit`/`fcgiwrap` read access, with `/var/www/.gitconfig` configuring `safe.directory = *`.
- **Repositories Root:** `/srv/git` (`02750` `git:git`)
- `/srv/git/.ssh/authorized_keys` (`0600` `git:git`): Contains authorized SSH public keys.
- `/srv/git/git-shell-commands/`: Custom `git-shell` helper commands (`init`, `list`, `no-interactive-login`) allowing remote creation of bare repositories via `ssh git@miguelpedro.xyz.br init <repo>.git "<description>"`.
- **Configuration:** `/etc/cgitrc` (enables `enable-http-clone=1`, syntax highlighting via Pygments, README rendering, and `scan-path=/srv/git`).
---
## 3. SearXNG, uWSGI & Valkey
SearXNG was installed using the official SearXNG installation script (`utils/searxng.sh`), running natively via `uwsgi` and backed by `valkey-server`.
### System User & Environment
- **User/Group:** `searxng` (`UID=988`, `GID=988`, home `/usr/local/searxng`, shell `/bin/bash`, member of `sudo` group).
- **Profile:** `/usr/local/searxng/.profile` automatically activates `/usr/local/searxng/searx-pyenv/bin/activate`.
- **Source Repository:** `/usr/local/searxng/searxng-src`
- Git remote: `https://github.com/searxng/searxng` (`master` branch, commit `b5ed73fcb6c6bda5d4e8b13d1472aa3917f784dc`).
- **Virtualenv:** `/usr/local/searxng/searx-pyenv`
### SearXNG Configuration (`/etc/searxng/`)
- **`/etc/searxng/settings.yml`** (`0640`, `searxng:searxng`):
- `use_default_settings: true`
- `general`: `debug: false`, `instance_name: "SearXNG"`
- `search`: `safe_search: 0`, `autocomplete: "duckduckgo"`, `formats: [html, json]`
- `server`: `secret_key` (32-char hex), `limiter: true`, `image_proxy: true`, `base_url: https://searx.miguelpedro.xyz.br/`
- `valkey`: `url: valkey://localhost:6379/0`
- **`/etc/searxng/limiter.toml`** (`0644`, `searxng:searxng`):
- Configures `[botdetection]` with `ipv4_prefix = 32`, `ipv6_prefix = 48`, `trusted_proxies = ['127.0.0.0/8', '::1']`, and `pass_searxng_org = true`.
### Application Server (uWSGI)
- **Service:** `uwsgi.service` (SysV/LSB service via `/etc/init.d/uwsgi`, configured by `/etc/default/uwsgi`).
- **App Config:** `/etc/uwsgi/apps-enabled/searxng.ini -> /etc/uwsgi/apps-available/searxng.ini`
- Runs as `uid = searxng`, `gid = searxng`
- `chdir = /usr/local/searxng/searxng-src/searx`
- `env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml`
- `disable-logging = true`, `chmod-socket = 666`
- `plugin = python3,http`, `workers = %k`, `threads = 4`, `offload-threads = %k`
- `module = searx.webapp`
- `virtualenv = /usr/local/searxng/searx-pyenv`
- `pythonpath = /usr/local/searxng/searxng-src`
- `socket = /usr/local/searxng/run/socket`
### Key-Value Store (Valkey)
- **Service:** `valkey-server.service` (active, enabled; aliased as `valkey.service`).
- **Config:** `/etc/valkey/valkey.conf` (bound to `127.0.0.1` and `-::1` on port `6379`, data dir `/var/lib/valkey`).
---
## 4. TLS/SSL & Firewall State
### TLS / Certbot
- **Packages:** `certbot`, `python3-certbot-nginx`
- **Timer:** `certbot.timer` (active, runs twice daily) and `/etc/cron.d/certbot`.
- **Certificates (`/etc/letsencrypt/live/`):**
1. `miguelpedro.xyz.br` (Domains: `miguelpedro.xyz.br`, `www.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`)
2. `searx.miguelpedro.xyz.br` (Domains: `searx.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`)
- **Shared Nginx TLS Configs:** `/etc/letsencrypt/options-ssl-nginx.conf` and `/etc/letsencrypt/ssl-dhparams.pem`.
### Firewall & Network
- **Listening Public Ports:**
- `22/tcp` (IPv4 & IPv6) — OpenSSH (`sshd`)
- `80/tcp` (IPv4 & IPv6) — Nginx HTTP
- `443/tcp` (IPv4 & IPv6) — Nginx HTTPS
- **Listening Loopback Ports:**
- `6379/tcp` (`127.0.0.1` & `::1`) — Valkey Server
- **Firewall State:**
- `ufw` and `iptables` are **not installed**.
- `nftables` (`/usr/sbin/nft`) is installed, with default empty tables in `/etc/nftables.conf`, and `nftables.service` is currently **disabled/inactive (dead)** (`nft list ruleset` is empty).
---
## 5. Complete Critical State Map
| Component | Critical Path on VPS | Purpose |
| :--- | :--- | :--- |
| **Nginx Core** | `/etc/nginx/nginx.conf` | Global Nginx settings (`server_tokens off`, TLS 1.2/1.3) |
| **Nginx VHosts** | `/etc/nginx/sites-available/default`<br>`/etc/nginx/sites-available/searxng.conf`<br>`/etc/nginx/sites-available/cgit.conf` | Main domain vhost, SearXNG reverse proxy vhost, and cgit vhost |
| **cgit & Git Repos** | `/etc/cgitrc`<br>`/srv/git/`<br>`/srv/git/git-shell-commands/`<br>`/run/fcgiwrap.socket` | cgit configuration, bare Git repositories (`git:git`), `git-shell` helpers, and FastCGI socket |
| **Nginx App Snippet** | `/etc/nginx/default.apps-available/searxng.conf` | `/searxng` sub-path snippet symlinked in `/etc/nginx/default.d/` |
| **Web Root** | `/var/www/html/`<br>`/var/www/miguelpedro.xyz.br/html/` | Static web roots |
| **SearXNG Config** | `/etc/searxng/settings.yml`<br>`/etc/searxng/limiter.toml` | SearXNG instance settings, secret key, Valkey URL, and bot limiter |
| **SearXNG App & Venv** | `/usr/local/searxng/searxng-src/`<br>`/usr/local/searxng/searx-pyenv/`<br>`/usr/local/searxng/run/socket` | SearXNG git clone, Python virtualenv, and uWSGI Unix socket |
| **uWSGI Config** | `/etc/uwsgi/apps-available/searxng.ini`<br>`/etc/default/uwsgi` | uWSGI worker configuration for SearXNG |
| **Valkey Config** | `/etc/valkey/valkey.conf`<br>`/var/lib/valkey/` | Local Redis-compatible store used by SearXNG limiter |
| **TLS Certificates** | `/etc/letsencrypt/live/*`<br>`/etc/letsencrypt/renewal/*.conf`<br>`/etc/letsencrypt/options-ssl-nginx.conf` | Certbot ECDSA certificates and renewal definitions |
| **Firewall** | `/etc/nftables.conf` | Nftables ruleset (currently inactive) |
|
