docker-proxied

General

Here, all the Docker containers that need to have proxied outgoing requests are being deployed. This is mainly for privacy-focused or alternative frontends and search engines that benefit from outgoing proxying.

Container explanations

• searx: SearxNG, a privacy-respecting metasearch engine aggregating results from various sources.
• librey: Librey, a metasearch engine with a focus on privacy and alternative search sources.
• lingva: Lingva Translate, a privacy-friendly alternative frontend for Google Translate.
• watchtower: Automatically updates running containers to the latest image versions.
• autoheal: Monitors containers and restarts them if they become unhealthy.

Restarting containers

This can happen via the following command:

sudo systemctl restart compose-runner-docker-proxied

Nix expression

{
  config,
  garuda-lib,
  sources,
  ...
}:
{
  imports = sources.defaultModules ++ [ ../../modules ];

  garuda =
    garuda-lib.mkMonitoring {
      host = "aerialis";
      units = [
        "compose-runner-docker-proxied.service"
        "docker.service"
      ];
    }
    // {
      services.compose-runner.docker-proxied = {
        envfile = config.sops.secrets."compose/docker-proxied".path;
        source = ../../../compose/docker-proxied;
      };
    };

  # Let Docker use squid as outgoig proxy
  # Fails to pull images if *.docker.io is not excluded from proxy
  # systemd.services.docker = {
  #   environment = {
  #     HTTPS_PROXY = "http://10.0.5.1:3128";
  #     HTTP_PROXY = "http://10.0.5.1:3128";
  #     NO_PROXY = "localhost,127.0.0.1,*.docker.io,ghcr.io";
  #   };
  # };

  sops.secrets."compose/docker-proxied" = { };

  system.stateVersion = "25.05";
}

Docker containers

services:
  searx:
    image: searxng/searxng:latest # It tends do be important to stay current
    container_name: searx
    volumes: ['./searxng:/etc/searxng']
    ports: ['8080:8080']
    environment:
      BASE_URL: https://searx.garudalinux.org/
      BIND_ADDRESS: 0.0.0.0:8080
      INSTANCE_NAME: Garuda's SearxNG
      NO_PROXY: '*.garudalinux.org'
    cap_drop: [ALL]
    cap_add: [CHOWN, SETGID, SETUID, DAC_OVERRIDE]
    healthcheck:
      test:
        - CMD
        - wget
        - --no-verbose
        - --tries=1
        - --spider
        - http://127.0.0.1:8080/info/en/about
      interval: 2m
      timeout: 5s
    restart: always
  librey:
    image: ghcr.io/ahwxorg/librey:latest # It tends do be important to stay current
    container_name: librey
    ports: ['8081:8080']
    environment:
      - CONFIG_CACHE_TIME=20
      - CONFIG_DISABLE_BITTORRENT_SEARCH=false
      - CONFIG_GOOGLE_DOMAIN=com
      - CONFIG_HIDDEN_SERVICE_SEARCH=true
      - CONFIG_INSTANCE_FALLBACK=true
      - CONFIG_INVIDIOUS_INSTANCE=https://invidious.snopyta.org
      - CONFIG_LANGUAGE=en
      - CONFIG_NUMBER_OF_RESULTS=10
      - CONFIG_RATE_LIMIT_COOLDOWN=25
      - CONFIG_TEXT_SEARCH_ENGINE=google
    healthcheck:
      test:
        - CMD
        - wget
        - --no-verbose
        - --tries=1
        - --spider
        - http://127.0.0.1:8080
      interval: 2m
      timeout: 5s
    restart: always
  lingva:
    image: thedaviddelta/lingva-translate:latest # Only latest tag is available
    container_name: lingva
    environment:
      DARK_THEME: 'true'
      DEFAULT_SOURCE_LANG: auto
      DEFAULT_TARGET_LANG: en
      SITE_DOMAIN: lingva.garudalinux.org
    ports: ['3002:3000']
    restart: always
  watchtower:
    image: nickfedor/watchtower:1.23.1
    container_name: watchtower
    command: --cleanup searx lingva librey
    volumes: ['/var/run/docker.sock:/var/run/docker.sock']
    restart: always
  autoheal:
    image: willfarrell/autoheal:latest
    container_name: autoheal
    environment:
      AUTOHEAL_CONTAINER_LABEL: all
    network_mode: none
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock
    restart: always