jklein
46942db53a
SearXNG as a stateless Deployment plus a settings ConfigMap, with the four CI steps a new chart needs: publish workflow, change-app-version choice list, ci/searxng/ fixtures and a renovate.json5 block. Three points where the chart is not a cyberchef with another name: * The image entrypoint writes settings.yml into /etc/searxng only when the file is missing. The chart always mounts one by subPath, so the copy and the random-secret sed never run and the container needs no write access there - which is what allows readOnlyRootFilesystem: true. * The signing key is a required OnePasswordItem, not a ConfigMap key. It signs the settings cookie and the image-proxy URLs, and the entrypoint's self-generating fallback cannot fire here, so without it the instance would run on the literal "ultrasecretkey" - which webapp.py refuses with exit 1. * All three probes use /healthz, the only path the bot detection lets through unconditionally. Measured: with the limiter active, "/" answers 429 while /healthz still answers 200. ingress.domain is read a second time outside the Ingress template, for SEARXNG_BASE_URL, and carries its own required() there - so it stays mandatory with the Ingress switched off. The Renovate versioning regex deviates from the plan on the issue and matches the commit hash WITHOUT capturing it. Renovate parses a "build" group with Number.parseInt, so a hash becomes the digits leading it; measured on renovate 41.173.1 and 44.48.0, the planned form reports an image pushed earlier the same day as an update to a newer one. Reasoning in the block and in README.
33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
# searxng: stateless, one secret and no infrastructure to stand up. The
|
|
# Ingress just has to apply - there is no ingress-nginx/cert-manager in the CI
|
|
# cluster.
|
|
#
|
|
# The install runs the DEFAULT path (bot detection off, no Valkey), which is
|
|
# what a real installation of this chart runs. The optional Valkey branch is
|
|
# rendered but not installed here: switching the limiter on without a reachable
|
|
# Valkey produces a Ready pod that logs an error per request, so it would make
|
|
# the install-test slower without making it stricter.
|
|
ingress:
|
|
domain: searxng.ci.local
|
|
clusterIssuer: ci
|
|
|
|
# The dummy 1Password Secret is created in fixtures.yaml; the operator does not
|
|
# run in CI, so the OnePasswordItem CR stays unfulfilled and only the stub CRD
|
|
# has to accept it.
|
|
secrets:
|
|
searxngSecretRef: op://ci/searxng/dummy
|
|
|
|
# Deliberately not the chart defaults. The install-test is the only place that
|
|
# proves the ConfigMap is more than a fixed file: instanceName exercises the
|
|
# first-class keys, and "extra" exercises the merge over them - including a
|
|
# nested map that has to be joined rather than replaced (search.safe_search
|
|
# from above must survive next to search.default_lang from here).
|
|
settings:
|
|
instanceName: "SearXNG CI"
|
|
safeSearch: 1
|
|
extra:
|
|
search:
|
|
default_lang: "en"
|
|
ui:
|
|
default_theme: simple
|