feat(services/searxng): add secret key

services/searxng/default.nix

@@ -3,5 +3,6 @@
     ./network.nix
     ./options.nix
     ./service.nix
+    ./secrets.nix
   ];
 }

services/searxng/secrets.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.machine.searxng;
+in
+with lib;
+mkIf cfg.enable {
+  sops.secrets = {
+    "searxng/secretKey" = {
+      sopsFile = ./../../secrets/common.yaml;
+      owner = config.users.users.matrix-synapse.name;
+      inherit (config.users.users.matrix-synapse) group;
+    };
+  };
+  sops.templates.searxng-env = {
+    owner = config.users.users.matrix-synapse.name;
+    inherit (config.users.users.matrix-synapse) group;
+    restartUnits = [ "matrix-synapse.service" ];
+    content = ''
+      SEARXNG_SECRET_KEY=${config.sops.placeholder."searxng/secretKey"};
+    '';
+  };
+}

services/searxng/service.nix

@@ -12,6 +12,8 @@ mkIf cfg.enable {
   services.searx = {
     enable = true;
     redisCreateLocally = true;
+    domain = cfg.domain;
+    environmentFile = config.sops.secrets.searx.path;
 
     # Rate limiting
     limiterSettings = {
@@ -65,7 +67,8 @@ mkIf cfg.enable {
       # Server configuration
       server = {
         base_url = if cfg.domain != null then "https://${cfg.domain}" else null end;
-        port = cfg.port;
+        secret_key = "@SEARXNG_SECRET_KEY@";
+        inherit (cfg) port;
         bind_address = "127.0.0.1";
         limiter = true;
         public_instance = true;