SearXNG Traefik/Dynamic script for Runtipi users

[ABOhiccups]

I've been using Runtipi to self host my own servers. The biggest challenge I've run into is setting up SearXNG as Public Instance. After chatting with ChatGPT and asking others for help. I got SearXNG A+ score and all requirement features enabled and working.

If you never heard Runtipi. It's a good Docker OS for beginners. Just visit Runtipi Website and it takes is one Linux command line to get Runtipi install and setup.

While Official Runtipi App Store does have SearXNG listed. I do not recommend download from that repro. The reason why. It does not have valkey database (which is required for server.public_instance to work). I recommend add falk's appstore repro in Settings -> App Stores page and than download SearXNG from falk's appstore.

falk's appstore
https://codeberg.org/falkheiland/runtipi-appstore

I made a Traefik/Dynamic script that will help you get your instance A+ Grade.

traefik/dynamic/dynamic.yml

http:
  serversTransports:
    insecuretransport:
      insecureSkipVerify: true
  middlewares:
    secure-headers-searxng:
      headers:
        contentSecurityPolicy: "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https:; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self'; img-src * data:; frame-src https:;"
        contentTypeNosniff: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        browserXssFilter: true
        forceSTSHeader: true
        frameDeny: true
  routers:
    security-searxng:
      entryPoints:
        - websecure
      rule: "Host(`search.abohiccups.com`)"
      middlewares:
        - secure-headers-searxng
      service: searxng
      priority: 100
  services:
    searxng:
      loadBalancer:
        servers:
          - url: "http://{CHANGE_TO_YOUR_LOCAL_IP_ADDRESS}:9022"

tls:
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/tls/cert.pem
        keyFile: /etc/traefik/tls/key.pem
  certificates:
    - certFile: /etc/traefik/tls/cert.pem
      keyFile: /etc/traefik/tls/key.pem
  options:
    default:
      minVersion: VersionTLS12
      maxVersion: VersionTLS13
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256   # Remove this line if CryptCheck fails to grade.
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384   # Remove this line if CryptCheck fails to grade.
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305   # Remove this line if CryptCheck fails to grade.
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      curvePreferences:
        - CurveP256
        - CurveP384
        - CurveP521
      sniStrict: true

Run a test on both CryptCheck and HTTP Observatory to make sure your instance gets A+ score.