From 4cb38e0b5873eda411c59719742df36f45c4839e Mon Sep 17 00:00:00 2001
From: toufic ar <contact@toufy.me>
Date: Mon, 21 Sep 2026 18:42:48 +0300
Subject: aphrodite: remove search, add dns

---
 aphrodite/default.nix        |   2 +-
 aphrodite/dns/default.nix    |  38 ++++++++++
 aphrodite/search/default.nix | 108 ---------------------------
 aphrodite/search/engines.nix | 171 -------------------------------------------
 4 files changed, 39 insertions(+), 280 deletions(-)
 create mode 100644 aphrodite/dns/default.nix
 delete mode 100644 aphrodite/search/default.nix
 delete mode 100644 aphrodite/search/engines.nix

(limited to 'aphrodite')

diff --git a/aphrodite/default.nix b/aphrodite/default.nix
index ad23015..57dfa5d 100644
--- a/aphrodite/default.nix
+++ b/aphrodite/default.nix
@@ -2,9 +2,9 @@
   imports = [
     ./network.nix
     ./devops
+    ./dns
     ./http
     ./mail
-    ./search
   ];
   system.stateVersion = "25.11";
 }
diff --git a/aphrodite/dns/default.nix b/aphrodite/dns/default.nix
new file mode 100644
index 0000000..6dc664d
--- /dev/null
+++ b/aphrodite/dns/default.nix
@@ -0,0 +1,38 @@
+{config, ...}: let
+  domain = config.customOps.domain.fqdn;
+in {
+  networking.firewall = {
+    allowedTCPPorts = [53 853];
+    allowedUDPPorts = [53];
+  };
+  services = {
+    kresd = {
+      enable = true;
+      listenPlain = [
+        "[::]:53"
+        "0.0.0.0:53"
+      ];
+      listenTLS = [
+        "[::]:853"
+        "0.0.0.0:853"
+      ];
+    };
+    doh-server = {
+      enable = true;
+      settings = {
+        path = "/";
+        upstream = ["udp:127.0.0.1:53"];
+      };
+    };
+    nginx.virtualHosts."dns.${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8053";
+        extraConfig = ''
+          proxy_http_version 1.1;
+        '';
+      };
+    };
+  };
+}
diff --git a/aphrodite/search/default.nix b/aphrodite/search/default.nix
deleted file mode 100644
index fb8cb2f..0000000
--- a/aphrodite/search/default.nix
+++ /dev/null
@@ -1,108 +0,0 @@
-{config, ...}: let
-  searxDomain = "search.${config.customOps.domain.fqdn}";
-in {
-  imports = [./engines.nix];
-
-  sops.secrets.searx.owner = "searx";
-
-  services.searx = {
-    enable = true;
-    redisCreateLocally = true;
-
-    limiterSettings = {
-      real_ip = {
-        x_for = 1;
-        ipv4_prefix = 32;
-        ipv6_prefix = 56;
-      };
-
-      botdetection = {
-        ip_limit = {
-          filter_link_local = true;
-          link_token = true;
-        };
-      };
-    };
-
-    faviconsSettings = {
-      favicons = {
-        cfg_schema = 1;
-        cache = {
-          db_url = "/var/cache/searx/faviconcache.db";
-          HOLD_TIME = 5184000;
-          LIMIT_TOTAL_BYTES = 2147483648;
-          BLOB_MAX_BYTES = 40960;
-          MAINTENANCE_MODE = "auto";
-          MAINTENANCE_PERIOD = 600;
-        };
-      };
-    };
-
-    settings = {
-      general = {
-        debug = false;
-        instance_name = "${config.customOps.owner.username}'s search";
-        donation_url = false;
-        contact_url = false;
-        privacypolicy_url = false;
-        enable_metrics = false;
-      };
-
-      ui = {
-        static_use_hash = true;
-        default_locale = "en";
-        query_in_title = false;
-        infinite_scroll = false;
-        center_alignment = false;
-        default_theme = "simple";
-        theme_args.simple_style = "auto";
-        search_on_category_select = false;
-        hotkeys = "vim";
-        url_formatting = "full";
-      };
-
-      search = {
-        safe_search = 0;
-        autocomplete_min = 2;
-        autocomplete = "duckduckgo";
-        favicon_resolver = "allesedv";
-        ban_time_on_fail = 5;
-        max_ban_time_on_fail = 120;
-      };
-
-      server = {
-        base_url = "https://${searxDomain}";
-        port = 8888;
-        bind_address = "127.0.0.1";
-        secret_key = config.sops.secrets.searx.path;
-        limiter = true;
-        public_instance = true;
-        image_proxy = false;
-        method = "POST";
-      };
-
-      outgoing = {
-        request_timeout = 30.0;
-        pool_connections = 100;
-        pool_maxsize = 15;
-        enable_http2 = true;
-      };
-
-      enabled_plugins = [
-        "Basic Calculator"
-        "Hash plugin"
-        "Tor check plugin"
-        "Open Access DOI rewrite"
-        "Hostnames plugin"
-        "Unit converter plugin"
-        "Tracker URL remover"
-      ];
-    };
-  };
-
-  services.nginx.virtualHosts.${searxDomain} = {
-    forceSSL = true;
-    enableACME = true;
-    locations."/".proxyPass = "http://localhost:8888";
-  };
-}
diff --git a/aphrodite/search/engines.nix b/aphrodite/search/engines.nix
deleted file mode 100644
index efde909..0000000
--- a/aphrodite/search/engines.nix
+++ /dev/null
@@ -1,171 +0,0 @@
-{lib, ...}: {
-  services.searx.settings.engines =
-    lib.mapAttrsToList (
-      name: value: {inherit name;} // value
-    ) {
-      # unnecessary
-      "bandcamp".inactive = true;
-      "github".inactive = true;
-      "dictzone".inactive = true;
-      "lingva".inactive = true;
-      "mymemory translated".inactive = true;
-      "mozhi".inactive = true;
-      "presearch".inactive = true;
-      "presearch images".inactive = true;
-      "presearch videos".inactive = true;
-      "presearch news".inactive = true;
-      "seznam".inactive = true;
-      "goo".inactive = true;
-      "naver".inactive = true;
-      "naver videos".inactive = true;
-      "naver images".inactive = true;
-      "naver news".inactive = true;
-      "alexandria".inactive = true;
-      "ask".inactive = true;
-      "crowdview".inactive = true;
-      "searchmysite".inactive = true;
-      "stract".inactive = true;
-      "bpb".inactive = true;
-      "tagesschau".inactive = true;
-      "wikimini".inactive = true;
-      "findthatmeme".inactive = true;
-      "frinkiac".inactive = true;
-      "livespace".inactive = true;
-      "sepiasearch".inactive = true;
-      "mediathekviewweb".inactive = true;
-      "ina".inactive = true;
-      "niconio".inactive = true;
-      "acfun".inactive = true;
-      "iqiyi".inactive = true;
-      "wolframalpha".inactive = true;
-      "ansa".inactive = true;
-      "il post".inactive = true;
-      "deezer".inactive = true;
-      "habrahabr".inactive = true;
-      "btdigg".inactive = true;
-      "duden".inactive = true;
-      "woxikon.de synonyme".inactive = true;
-      "jisho".inactive = true;
-      "moviepilot".inactive = true;
-      "senscritique".inactive = true;
-      "geizhals".inactive = true;
-      "openmeteo".inactive = true;
-      "fyyd".inactive = true;
-      "yummly".inactive = true;
-      "chefkoch".inactive = true;
-      "destatis".inactive = true;
-      # big brother
-      "google".inactive = true;
-      "bing".inactive = true;
-      "google play movies".inactive = true;
-      "google play apps".inactive = true;
-      "google news".inactive = true;
-      "google images".inactive = true;
-      "google videos".inactive = true;
-      "google scholar".inactive = true;
-      "youtube".inactive = true;
-      "bing images".inactive = true;
-      "bing videos".inactive = true;
-      "bing news".inactive = true;
-      "microsoft learn".inactive = true;
-      "material icons".inactive = true;
-      "apple maps".inactive = true;
-      "apple app store".inactive = true;
-      "goodreads".inactive = true;
-      # captcha
-      "cppreference".inactive = true;
-      "lib.rs".inactive = true;
-      "sourcehut".inactive = true;
-      "free software directory".inactive = true;
-      "searchcode code".inactive = true;
-      "pdbe".inactive = true;
-      "1337x".inactive = true;
-      "kickass".inactive = true;
-      "library genesis".inactive = true;
-      "openrepos".inactive = true;
-      "tokyotoshokan".inactive = true;
-      "duckduckgo images".inactive = true;
-      "duckduckgo videos".inactive = true;
-      "duckduckgo news".inactive = true;
-      "duckduckgo weather".inactive = true;
-      "mojeek images".inactive = true;
-      "mojeek news".inactive = true;
-      "qwant images".inactive = true;
-      "qwant videos".inactive = true;
-      "qwant news".inactive = true;
-      # non-free
-      "tineye".inactive = true;
-      "1x".inactive = true;
-      "adobe stock".inactive = true;
-      "adobe stock video".inactive = true;
-      "adobe stock audio".inactive = true;
-      "deviantart".inactive = true;
-      "flickr".inactive = true;
-      "imgur".inactive = true;
-      "library of congress".inactive = true;
-      "pinterest".inactive = true;
-      "unsplash".inactive = true;
-      "bilibili".inactive = true;
-      "dailymotion".inactive = true;
-      "vimeo".inactive = true;
-      "yahoo".inactive = true;
-      "yahoo news".inactive = true;
-      "genius".inactive = true;
-      "mixcloud".inactive = true;
-      "soundcloud".inactive = true;
-      "huggingface".inactive = true;
-      "huggingface datasets".inactive = true;
-      "huggingface spaces".inactive = true;
-      "9gag".inactive = true;
-      "reddit".inactive = true;
-      "imdb".inactive = true;
-      "rottentomatoes".inactive = true;
-      # shady
-      "right dao".inactive = true;
-      "quark".inactive = true;
-      "quark images".inactive = true;
-      "sogou".inactive = true;
-      "sogou images".inactive = true;
-      "sogou wechat".inactive = true;
-      "sogou videos".inactive = true;
-      # LLM
-      "cloudflareai".inactive = true;
-      "yacy".inactive = true;
-      "yacy images".inactive = true;
-      "yep".inactive = true;
-      "yep images".inactive = true;
-      "yep news".inactive = true;
-      "360search".inactive = true;
-      "360search videos".inactive = true;
-      "baidu".inactive = true;
-      "baidu images".inactive = true;
-      "baidu kaifa".inactive = true;
-      "seekr images".inactive = true;
-      "seekr news".inactive = true;
-      "seekr videos".inactive = true;
-      # censorship
-      "reuters".inactive = true;
-      "duckduckgo".inactive = true;
-      # far-right/disinformation/misinformation
-      "bitchute".inactive = true;
-      "rumble".inactive = true;
-      "mulvaddelta".inactive = true;
-      "mulvaddelta brave".inactive = true;
-      "brave".inactive = true;
-      # slow
-      "crossref".inactive = true;
-      "wikidata".inactive = true;
-
-      # enabled
-      "mwmbl".disabled = false;
-      "mwmbl".weight = 0.9;
-      "startpage".disabled = false;
-      "startpage".weight = 0.8;
-      "qwant".disabled = false;
-      "qwant".weight = 0.7;
-      "mojeek".disabled = false;
-      "mojeek".weight = 0.6;
-      "wiby".disabled = false;
-      "wiby".weight = 0.5;
-    };
-}
-- 
cgit v1.3.1