From a1cb8b4a0b597a30c970b29a32f4756c6996911e Mon Sep 17 00:00:00 2001
From: tomit4 <mosssap@gmail.com>
Date: Sat, 13 Sep 2025 14:14:48 -0700
Subject: [PATCH] :wrench: Just a hacky script to get searxng etc. working

---
 scripts/rs                                    |   4 +
 self_host/self_host/README.md                 |  11 +
 self_host/self_host/docker-compose.yaml       | 145 +++++++++++++
 self_host/self_host/gen_new_tokens.sh         |   8 +
 .../self_host/searxng-docker.service.template |  16 ++
 self_host/self_host/searxng/limiter.toml      |   7 +
 self_host/self_host/searxng/settings.yml      | 202 ++++++++++++++++++
 7 files changed, 393 insertions(+)
 create mode 100755 scripts/rs
 create mode 100644 self_host/self_host/README.md
 create mode 100644 self_host/self_host/docker-compose.yaml
 create mode 100755 self_host/self_host/gen_new_tokens.sh
 create mode 100644 self_host/self_host/searxng-docker.service.template
 create mode 100644 self_host/self_host/searxng/limiter.toml
 create mode 100644 self_host/self_host/searxng/settings.yml

diff --git a/scripts/rs b/scripts/rs
new file mode 100755
index 00000000..dee9f5a9
--- /dev/null
+++ b/scripts/rs
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+docker compose -f "$HOME"/aur_packages/self_host/docker-compose.yaml down 2>/dev/null
+docker compose -f "$HOME"/aur_packages/self_host/docker-compose.yaml up -d 2>/dev/null
diff --git a/self_host/self_host/README.md b/self_host/self_host/README.md
new file mode 100644
index 00000000..11d28796
--- /dev/null
+++ b/self_host/self_host/README.md
@@ -0,0 +1,11 @@
+This is just a compilation of my most common locally run applications via
+docker.
+
+Just:
+
+```sh
+# To spin up
+docker compose up -d
+# To spin down
+docker compose down
+```
diff --git a/self_host/self_host/docker-compose.yaml b/self_host/self_host/docker-compose.yaml
new file mode 100644
index 00000000..33ecff74
--- /dev/null
+++ b/self_host/self_host/docker-compose.yaml
@@ -0,0 +1,145 @@
+services:
+  # PIHOLE
+  # https://github.com/mpgirro/docker-pihole-unbound/blob/main/example/compose.yaml
+  pihole-unbound:
+    container_name: pihole-unbound
+    image: mpgirro/pihole-unbound:latest
+    hostname: ${HOSTNAME}
+    domainname: ${DOMAIN_NAME}
+    ports:
+      - 443:443/tcp
+      - 53:53/tcp
+      - 53:53/udp
+      - ${PIHOLE_WEBPORT:-80}:80/tcp #Allows use of different port to access pihole web interface when other docker containers use port 80
+      - 5335:5335/tcp # Uncomment to enable unbound access on local server
+      # - 22/tcp # Uncomment to enable SSH
+    environment:
+      - TZ=${TZ:-UTC}
+      - FTLCONF_webserver_api_password=${WEBPASSWORD}
+      - FTLCONF_webserver_interface_theme=${WEBTHEME:-default-dark}
+      - FTLCONF_dns_upstreams=127.0.0.1#5335
+      # - FTLCONF_dns_listeningMode=single
+      - FTLCONF_dns_listeningMode=all
+      - FTLCONF_webserver_port=80
+    volumes:
+      - etc_pihole-unbound:/etc/pihole:rw
+      - etc_pihole_dnsmasq-unbound:/etc/dnsmasq.d:rw
+    restart: always
+  # SEARXNG
+  searxng:
+    container_name: searxng
+    image: docker.io/searxng/searxng:latest
+    restart: always
+    ports:
+      # - "127.0.0.1:8080:8080"
+      - "8080:8080"
+    volumes:
+      - ./searxng:/etc/searxng:rw
+      - searxng-data:/var/cache/searxng:rw
+    environment:
+      - SEARXNG_BASE_URL=https://${SEARXNG_HOSTNAME:-localhost}/
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "1m"
+        max-file: "1"
+    # dns:
+      # - 8.8.8.8
+      # - 8.8.4.4
+  # REDLIB
+  redlib:
+    image: quay.io/redlib/redlib:latest
+    restart: always
+    container_name: "redlib"
+    ports:
+      - 8081:8080 # Specify `127.0.0.1:8080:8080` instead if using a reverse proxy
+    user: nobody
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+      # - seccomp=seccomp-redlib.json
+    cap_drop:
+      - ALL
+    env_file: .env
+    # networks:
+      # - redlib
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
+      interval: 5m
+      timeout: 3s
+  # INVIDIOUS
+  invidious:
+    image: quay.io/invidious/invidious:latest
+    # image: quay.io/invidious/invidious:latest-arm64 # ARM64/AArch64 devices
+    restart: unless-stopped
+    ports:
+      - "3001:3000"
+    environment:
+      # Please read the following file for a comprehensive list of all available
+      # configuration options and their associated syntax:
+      # https://github.com/iv-org/invidious/blob/master/config/config.example.yml
+      INVIDIOUS_CONFIG: |
+        db:
+          dbname: invidious
+          user: kemal
+          password: kemal
+          host: invidious-db
+          port: 5432
+        check_tables: true
+        signature_server: inv_sig_helper:12999
+        visitor_data: "CgtTbC0tbG84N1hjVSjdmc_FBjIKCgJVUxIEGgAgKQ%3D%3D"
+        po_token: "IggXWBdaf-vbvg=="
+        # external_port:
+        # domain:
+        # https_only: false
+        # statistics_enabled: false
+        hmac_key: "aiZoghooQuies7aidei0"
+    healthcheck:
+      test: wget -nv --tries=1 --spider http://127.0.0.1:3000/api/v1/trending || exit 1
+      interval: 30s
+      timeout: 5s
+      retries: 2
+    logging:
+      options:
+        max-size: "1G"
+        max-file: "4"
+    depends_on:
+      - invidious-db
+  inv_sig_helper:
+    image: quay.io/invidious/inv-sig-helper:latest
+    init: true
+    command: ["--tcp", "0.0.0.0:12999"]
+    environment:
+      - RUST_LOG=info
+    restart: always
+    cap_drop:
+      - ALL
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+
+  invidious-db:
+    image: docker.io/library/postgres:14
+    restart: unless-stopped
+    volumes:
+      - postgresdata:/var/lib/postgresql/data
+      - ./config/sql:/config/sql
+      - ./docker/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh
+    environment:
+      POSTGRES_DB: invidious
+      POSTGRES_USER: kemal
+      POSTGRES_PASSWORD: kemal
+    healthcheck:
+      # test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
+      test: ["CMD-SHELL", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
+volumes:
+  # PIHOLE
+  etc_pihole-unbound:
+  etc_pihole_dnsmasq-unbound:
+  # SEARXNG
+  searxng-data:
+  # INVIDIOUS
+  postgresdata:
+
+# networks:
+  # redlib:
diff --git a/self_host/self_host/gen_new_tokens.sh b/self_host/self_host/gen_new_tokens.sh
new file mode 100755
index 00000000..b6c5e2b8
--- /dev/null
+++ b/self_host/self_host/gen_new_tokens.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+# NOTE: It is recommended you change these once in a while in the docker-compose.yml
+# NOTE: You can also generate a new hmac_key using pwgen
+# `pwgen 20 1` and pasting that in the hmac_key section of the docker-compose.yml file.
+
+echo "GENERATING NEW visitor_data AND po_token"
+docker run quay.io/invidious/youtube-trusted-session-generator
diff --git a/self_host/self_host/searxng-docker.service.template b/self_host/self_host/searxng-docker.service.template
new file mode 100644
index 00000000..29a508c0
--- /dev/null
+++ b/self_host/self_host/searxng-docker.service.template
@@ -0,0 +1,16 @@
+[Unit]
+Description=SearXNG service
+Requires=docker.service
+After=docker.service
+
+[Service]
+Restart=on-failure
+
+Environment=SEARXNG_DOCKERCOMPOSEFILE=docker-compose.yaml
+
+WorkingDirectory=/usr/local/searxng-docker
+ExecStart=/usr/local/bin/docker compose -f ${SEARXNG_DOCKERCOMPOSEFILE} up --remove-orphans
+ExecStop=/usr/local/bin/docker compose -f ${SEARXNG_DOCKERCOMPOSEFILE} down
+
+[Install]
+WantedBy=multi-user.target
diff --git a/self_host/self_host/searxng/limiter.toml b/self_host/self_host/searxng/limiter.toml
new file mode 100644
index 00000000..14ca0c27
--- /dev/null
+++ b/self_host/self_host/searxng/limiter.toml
@@ -0,0 +1,7 @@
+# This configuration file updates the default configuration file
+# See https://github.com/searxng/searxng/blob/master/searx/limiter.toml
+
+[botdetection.ip_limit]
+# activate advanced bot protection
+# enable this when running the instance for a public usage on the internet
+link_token = false
diff --git a/self_host/self_host/searxng/settings.yml b/self_host/self_host/searxng/settings.yml
new file mode 100644
index 00000000..aa6ef5c6
--- /dev/null
+++ b/self_host/self_host/searxng/settings.yml
@@ -0,0 +1,202 @@
+# see https://docs.searxng.org/admin/settings/settings.html#settings-use-default-settings
+use_default_settings: true
+server:
+  # base_url is defined in the SEARXNG_BASE_URL environment variable, see .env and docker-compose.yml
+  secret_key: "d3ce536cad273a010ca43c7019873041efd3d94e152a1a5fb1f863686fac90a2"  # change this!
+  limiter: false  # enable this when running the instance for a public usage on the internet
+  image_proxy: true
+  bind_address: 0.0.0.0
+  method: GET
+redis:
+  url: redis://redis:6379/0
+engines:
+  - name: duckduckgo
+    disabled: false
+  - name: mojeek
+    disabled: false
+  - name: mullvadleta
+    disabled: false
+  - name: mullvadleta brave
+    disabled: false
+  - name: dictzone
+    disabled: true
+  - name: lingva
+    disabled: true
+  - name: mymemory translated
+    disabled: true
+  - name: bing
+    disabled: true
+  - name: google
+    disabled: true
+  - name: brave
+    disabled: true
+  - name: startpage
+    disabled: true
+  - name: currency
+    disabled: true
+  - name: wikidata
+    disabled: true
+  - name: wikipedia
+    disabled: true
+  - name: duckduckgo images
+    disabled: false
+  - name: bing images
+    disabled: false
+  - name: brave.images
+    disabled: true
+  - name: google images
+    disabled: false
+  - name: qwant images
+    disabled: true
+  - name: startpage images
+    disabled: true
+  - name: artic
+    disabled: true
+  - name: deviantart
+    disabled: true
+  - name: flickr
+    disabled: true
+  - name: openverse
+    disabled: true
+  - name: pinterest
+    disabled: true
+  - name: public domain image archive
+    disabled: true
+  - name: unsplash
+    disabled: true
+  - name: wikicommons.images
+    disabled: true
+  - name: bing videos
+    disabled: false
+  - name: brave.videos
+    disabled: true
+  - name: google videos
+    disabled: false
+  - name: qwant videos
+    disabled: true
+  - name: duckduckgo videos
+    disabled: false
+  - name: dailymotion
+    disabled: true
+  - name: piped
+    disabled: true
+  - name: sepiasearch
+    disabled: true
+  - name: vimeo
+    disabled: false
+  - name: wikicommons.videos
+    disabled: true
+  - name: youtube
+    disabled: false
+  - name: startpage news
+    disabled: true
+  - name: wikinews
+    disabled: true
+  - name: bing news
+    disabled: true
+  - name: brave.news
+    disabled: true
+  - name: google news
+    disabled: false
+  - name: qwant news
+    disabled: true
+  - name: reuters
+    disabled: true
+  - name: yahoo news
+    disabled: false
+  - name: openstreetmap
+    disabled: false
+  - name: photon
+    disabled: true
+  - name: genius
+    disabled: true
+  - name: radio browser
+    disabled: true
+  - name: bandcamp
+    disabled: false
+  - name: mixcloud
+    disabled: true
+  - name: piped.music
+    disabled: true
+  - name: soundcloud
+    disabled: false
+  - name: wikicommons.audio
+    disabled: true
+  - name: alpine linux packages
+    disabled: false
+  - name: crates.io
+    disabled: false
+  - name: docker hub
+    disabled: false
+  - name: hoogle
+    disabled: true
+  - name: npm
+    disabled: false
+  - name: pypi
+    disabled: false
+  - name: rubygems
+    disabled: false
+  - name: voidlinux
+    disabled: false
+  - name: askubuntu
+    disabled: false
+  - name: stackoverflow
+    disabled: false
+  - name: superuser
+    disabled: true
+  - name: codeberg
+    disabled: false
+  - name: github
+    disabled: false
+  - name: gitlab
+    disabled: false
+  - name: arch linux wiki
+    disabled: false
+  - name: gentoo
+    disabled: false
+  - name: mankier
+    disabled: true
+  - name: mdn
+    disabled: false
+  - name: apk mirror
+    disabled: false
+  - name: fdroid
+    disabled: false
+  - name: google play apps
+    disabled: false
+  - name: annas archive
+    disabled: false
+  - name: bt4g
+    disabled: true
+  - name: kickass
+    disabled: true
+  - name: library genesis
+    disabled: false
+  - name: nyaa
+    disabled: false
+  - name: piratebay
+    disabled: true
+  - name: solidtorrents
+    disabled: true
+  - name: wikicommons.files
+    disabled: true
+  - name: z-library
+    disabled: false
+  - name: reddit
+    disabled: false
+  - name: etymonline
+    disabled: true
+  - name: wiktionary
+    disabled: true
+  - name: wordnik
+    disabled: true
+  - name: podcastindex
+    disabled: true
+  - name: erowid
+    disabled: false
+  - name: steam
+    disabled: false
+  - name: chefkoch
+    disabled: true
+ui:
+  center_alignment: true