# https://github.com/tomMoulard/make-my-server/blob/master/searxng/docker-compose.searxng.yml
# https://github.com/searxng/searxng-docker/blob/master/docker-compose.yaml
version: "2"
services:
  srv_searxng:
    user: ${PUID}:${PGID}
    container_name: ${C_SXN}
    image: ${C_SXN_IMG}
    restart: ${C_ALL_RESTART}
    hostname: ${C_SXN_HOST}   
    ports:
      - ${C_SXN_8080}:8080
    volumes:
      - ${REP_APPDATA}/${C_SXN}/:/etc/searxng
    environment:
      - SEARXNG_REDIS_URL=redis://${C_VK_HOST}:6379/0
      - SEARXNG_BASE_URL=https://${C_SXN_HOST}.${DOML}/
      - SEARXNG_PORT=8080
    healthcheck:
      test: ['CMD',
             'wget', '-q', '--spider', '--proxy=off', 'localhost:8080/healthz']
    labels:
      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}"
    networks:
      default:
      web:
networks:
  default:
    external:
      name: $NET_TFK
  web:
    external:
      name: $NET_WEB


# https://github.com/bitnami/containers/blob/main/bitnami/valkey/README.md
# https://github.com/bitnami/containers/blob/main/bitnami/valkey/docker-compose.yml
version: "3.9"
services:
  srv_valkey:
    user: ${PUID}:${PGID}
    container_name: ${C_VK}
    image: ${C_VK_IMG}    
    restart: ${C_ALL_RESTART_NO}
    command: valkey-server --save 30 1 --loglevel warning
    hostname: ${C_VK_HOST}
    ports:
      - ${C_VK_6379}:6379
    volumes:
      - ${REP_APPDATA}/${C_VK}:/bitnami/valkey/data
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
      - VALKEY_DISABLE_COMMANDS=FLUSHDB,FLUSHALL
    labels:
      - "com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}"
    networks:
      web:
        ipv4_address: ${C_VK_IP_WEB}
networks: 
  web: 
    external: true

http:
 #region routers 
  routers:
# ----------------- searxng -----------------
    searxng:
      entryPoints:
        - "https"
      rule: "Host(`sxng.l.d0ge.ovh`) && (Method(`GET`)||Method(`POST`)||Method(`HEAD`))"
      middlewares:
        - default-headers
        - searxng-headers
        - https-redirectscheme
      service: searxng
      tls: {}

#region services
  services:

# ----------------- searxng -----------------
    searxng:
      loadBalancer:
        servers:
          - url: "http://sxng:8080"
        passHostHeader: true

#endregion - services

  middlewares:
    https-redirectscheme:
      redirectScheme:
        scheme: https
        permanent: true

    default-headers:
      headers:
        frameDeny: true
        browserXssFilter: true
        contentTypeNosniff: true
        referrerPolicy: "no-referrer"
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 15552000
        customFrameOptionsValue: SAMEORIGIN
        customRequestHeaders:
          X-Forwarded-Proto: https

    default-whitelist:
      ipWhiteList:
        sourceRange:
        - "10.0.0.0/8"
        - "192.168.50.0/16"
        - "172.16.0.0/12"

    secured:
      chain:
        middlewares:
        - default-whitelist
        - default-headers

    searxng-headers:
      headers:
        customResponseHeaders:
          X-Robots-Tag: "noindex, noarchive, nofollow"
          Permissions-Policy: "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()"