feat(searxng): limiter

src/cspell.yaml

@@ -533,6 +533,7 @@ ignoreWords:
   - codeberg
   - sourcehut
   - uwsgi
+  - valkey
   - startpage
   - crossref
   - freesound

src/modules/services/searxng/raise-api-limit.patch

@@ -0,0 +1,13 @@
+diff --git a/searx/botdetection/ip_limit.py b/searx/botdetection/ip_limit.py
+index b2559a97b..fbdc318fe 100644
+--- a/searx/botdetection/ip_limit.py
++++ b/searx/botdetection/ip_limit.py
+@@ -79,7 +79,7 @@ LONG_MAX_SUSPICIOUS = 10
+ API_WINDOW = 3600
+ """Time (sec) before sliding window for API requests (format != html) expires."""
+
+-API_MAX = 4
++API_MAX = 60
+ """Maximum requests from one IP in the :py:obj:`API_WINDOW`"""
+
+ SUSPICIOUS_IP_WINDOW = 3600 * 24 * 30

src/modules/services/searxng/searxng.nix

@@ -1,6 +1,7 @@
 {
   machines.nixosModules.searxng =
     {
+      pkgs,
       config,
       lib,
       ...
@@ -11,6 +12,10 @@
 
       hardware = config.dot.hardware;
 
+      searxng = pkgs.searxng.overridePythonAttrs (old: {
+        patches = (old.patches or [ ]) ++ [ ./raise-api-limit.patch ];
+      });
+
       failingEngines = [
         # NOTE: these don't even pass a start check
         "torch"
@@ -39,24 +44,31 @@
         url = "http://${address}:${builtins.toString port}";
       };
 
+      services.redis.package = pkgs.valkey;
+
       services.searx = {
         enable = true;
 
+        package = searxng;
+
         configureUwsgi = false;
-        redisCreateLocally = false;
+        redisCreateLocally = true;
 
         settings = {
           search.formats = [
             "html"
             "json"
           ];
+
           server = {
             port = port;
             bind_address = address;
             secret_key = "local-only";
-            limiter = false;
+            limiter = true;
           };
+
           use_default_settings.engines.remove = failingEngines;
+
           engines =
             defaultEngines
             ++ (builtins.map