Post

Upgrading Searx jail to 0.17

Searx is a privacy respecting search proxy aggregating results from different Internet search engines. I have it running in a jail since some time now, and I wanted to upgrade to the latest version 0.17, but this version is not in FreeBSD ports, so I upgraded it manually. Here is a quick writeup how I did it.

1. Bootstrap a new jail

I like to do upgrades by rebuilding jail from scratch, reinstall all software, packages, then put back the data, if there is any. I’ll name the jail searx2, because the old version is still running in another one named searx.

1
zfs clone rpool/poudriere/stable/12/dist-nokern-20200806@20200806 rpool/jail/searx2

Add new entry in /etc/jail.conf

1
searx2  { ip4.addr = vlan2|192.168.X.X; }

Start the jail, enter it, and bootstrap pkg

1
2
3
/etc/rc.d/jail start searx2
jexec searx2 sh
pkg

2. Prepare jail packages

1
2
3
4
# Joe is my preferred editor, bash will be Searx service shell, we also need Git to pull the sources
pkg install bash joe git-lite
# Searx needs a few Python packages
pkg install py37-babel py37-requests py37-yaml py37-pygments py37-werkzeug py37-Flask py37-Flask-Babel py37-lxml py37-dateutil

3. Install Searx from source

Create service account

1
NAME=searx ID=8888 && pw groupadd -n $NAME -g $ID && pw useradd -n $NAME -g $NAME -u $ID -s /usr/local/bin/bash -w no -d /home/$NAME -m -M 750

Prepare settings file

1
2
3
4
fetch https://raw.githubusercontent.com/searx/searx/master/searx/settings.yml
mv settings.yml /usr/local/etc/searx-settings.yml
# edit settings, change secret_key, base_url (it runs behing rev.proxy)
joe /usr/local/etc/searx-settings.yml

Pull Searx sources and prepare settings

1
2
3
4
5
6
su searx
cd
git clone https://github.com/searx/searx
cd searx
# start Searx manually to checks if it runs ok and nothing is missing
SEARX_SETTINGS_PATH=/usr/local/etc/searx-settings.yml ./searx/webapp.py

Install Searx as service

Startup rc script is already installed from previous ports version, lets reuse it, cp it from the old jail into new one.

1
2
# as root on host, my jails are mounted under /jail
cp /jail/srx/usr/local/etc/rc.d/searx /jail/srx2/usr/local/etc/rc.d/

Then I will edit the rc file to adjust Python version, service account and settings file, here is the diff compared to the existing rc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
--- /jail/srx/usr/local/etc/rc.d/searx	2019-03-26 09:27:18.000000000 +0100
+++ /jail/srx2/usr/local/etc/rc.d/searx	2020-09-19 09:51:23.997346000 +0200
@@ -25,14 +25,15 @@
 rcvar=searx_enable
 
 : ${searx_enable:="NO"}
-: ${searx_user:="www"}
-: ${searx_group:="www"}
+: ${searx_user:="searx"}
+: ${searx_group:="searx"}
+: ${searx_conf:="/usr/local/etc/searx-settings.yml"}
 : ${searx_flags:=""}
 
 # daemon
 pidfile="/var/run/${name}.pid"
-python="/usr/local/bin/python2.7"
-script_py="/usr/local/lib/python2.7/site-packages/${name}/webapp.py"
+python="/usr/local/bin/python3.7"
+script_py="/home/${name}/searx/searx/webapp.py"
 command=/usr/sbin/daemon
 procname="daemon"
 command_args=" -c -f -P ${pidfile} ${python} ${script_py}"
@@ -41,6 +42,7 @@
 searx_precmd()
 {
     install -o ${searx_user} /dev/null ${pidfile}
+    export SEARX_SETTINGS_PATH=${searx_conf}
 }
 
 load_rc_config $name

The full final rc startup file

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/bin/sh
# $FreeBSD: head/www/searx/files/searx.in 463944 2018-03-09 08:34:57Z yuri $

# PROVIDE: searx
# REQUIRE: DAEMON NETWORKING
# BEFORE: LOGIN
# KEYWORD: shutdown

# Add the following lines to /etc/rc.conf to enable searx:
# searx_enable="YES"
#
# searx_enable (bool):	Set to YES to enable searx
#				Default: NO
# searx_conf (str):		searx configuration file
#				Default: ${PREFIX}/etc/searx.conf
# searx_user (str):		searx daemon user
#				Default: searx
# searx_group (str):		searx daemon group
#				Default: searx
# searx_flags (str):		Extra flags passed to searx

. /etc/rc.subr

name="searx"
rcvar=searx_enable

: ${searx_enable:="NO"}
: ${searx_user:="searx"}
: ${searx_group:="searx"}
: ${searx_conf:="/usr/local/etc/searx-settings.yml"}
: ${searx_flags:=""}

# daemon
pidfile="/var/run/${name}.pid"
python="/usr/local/bin/python3.7"
script_py="/home/${name}/searx/searx/webapp.py"
command=/usr/sbin/daemon
procname="daemon"
command_args=" -c -f -P ${pidfile} ${python} ${script_py}"
start_precmd="searx_precmd"

searx_precmd()
{
    install -o ${searx_user} /dev/null ${pidfile}
    export SEARX_SETTINGS_PATH=${searx_conf}
}

load_rc_config $name
run_rc_command "$1"

Enable Searx service to run automagically when jails starts

1
2
sysrc search_enable=YES
/usr/local/etc/rc.d/searx start

4. Switch the jails

Now if all looks good, I can switch the jails. Get out from jail and do as root

1
2
3
4
5
6
7
/etc/rc.d/jail stop srx srx2
zfs rename rpool/jail/srx  rpool/jail/srx_old
zfs rename rpool/jail/srx2 rpool/jail/srx
# sometimes when jail runs for a long time, "zfs rename" could fail
# with "umount error" - in that case force it with "zfs umount -f .."
# before rename, then "zfs mount .." it afterwards
/etc/rc.d/jail start srx

5. H2O conf for Searx

Here is the H2O frontend configuration part for Searx, it’s not public, restricted with a few IP acls.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
  "srx.uoga.net:80":
    listen:
      host: 192.168.Y.Y
      port: 80
    paths:
      "/":
        redirect:
          status: 301
          url: "https://srx.uoga.net/"
      "/.well-known/acme-challenge":
        file.dir: "/usr/local/www/dehydrated"

  "srx.uoga.net:443":
    listen:
      host: 192.168.Y.Y
      port: 443
      ssl:
        certificate-file: /usr/local/etc/dehydrated/certs/srx.uoga.net/fullchain.pem
        key-file: /usr/local/etc/dehydrated/certs/srx.uoga.net/privkey.pem
    paths:
      "/":
        mruby.handler: |
          require "trie_addr.rb"
          trie = TrieAddr.new.add(["192.168.A.A/24","192.168.B.B/24"])
          acl {
            allow { trie.match?(addr) }
            allow { addr == "A.B.C.D" }
            deny
          }
        proxy.reverse.url: http://192.168.X.X:8888
        proxy.preserve-host: ON

© Evaldas Auryla.

Using the Chirpy theme for Jekyll.