{config, ...}: let
  searxDomain = "search.${config.customOps.domain.fqdn}";
in {
  imports = [./engines.nix];

  sops.secrets.searx.owner = "searx";

  services.searx = {
    enable = true;
    redisCreateLocally = true;

    limiterSettings = {
      real_ip = {
        x_for = 1;
        ipv4_prefix = 32;
        ipv6_prefix = 56;
      };

      botdetection = {
        ip_limit = {
          filter_link_local = true;
          link_token = true;
        };
      };
    };

    faviconsSettings = {
      favicons = {
        cfg_schema = 1;
        cache = {
          db_url = "/var/cache/searx/faviconcache.db";
          HOLD_TIME = 5184000;
          LIMIT_TOTAL_BYTES = 2147483648;
          BLOB_MAX_BYTES = 40960;
          MAINTENANCE_MODE = "auto";
          MAINTENANCE_PERIOD = 600;
        };
      };
    };

    settings = {
      general = {
        debug = false;
        instance_name = "${config.customOps.owner}'s search";
        donation_url = false;
        contact_url = false;
        privacypolicy_url = false;
        enable_metrics = false;
      };

      ui = {
        static_use_hash = true;
        default_locale = "en";
        query_in_title = false;
        infinite_scroll = true;
        center_alignment = false;
        default_theme = "simple";
        theme_args.simple_style = "auto";
        search_on_category_select = true;
        hotkeys = "vim";
        url_formatting = "full";
      };

      search = {
        safe_search = 0;
        autocomplete_min = 2;
        autocomplete = "duckduckgo";
        favicon_resolver = "allesedv";
        ban_time_on_fail = 5;
        max_ban_time_on_fail = 120;
      };

      server = {
        base_url = "https://${searxDomain}";
        port = 8888;
        bind_address = "127.0.0.1";
        secret_key = config.sops.secrets.searx.path;
        limiter = true;
        public_instance = true;
        image_proxy = false;
        method = "POST";
      };

      outgoing = {
        request_timeout = 5.0;
        max_request_timeout = 15.0;
        pool_connections = 100;
        pool_maxsize = 15;
        enable_http2 = true;
      };

      enabled_plugins = [
        "Basic Calculator"
        "Hash plugin"
        "Tor check plugin"
        "Open Access DOI rewrite"
        "Hostnames plugin"
        "Unit converter plugin"
        "Tracker URL remover"
      ];
    };
  };

  services.nginx.virtualHosts.${searxDomain} = {
    forceSSL = true;
    enableACME = true;
    locations."/".proxyPass = "http://localhost:8888";
  };
}