@@ -4,19 +4,303 @@
44Install with apache
55===================
66
7−.. sidebar:: public to the internet?
8−
9− If your searx instance is public, stop here and first install :ref:`filtron
10− reverse proxy <filtron.sh>` and :ref:`result proxy morty <morty.sh>`, see
11− :ref:`installation scripts`.
7+.. _Apache: https://httpd.apache.org/
8+.. _Apache Debian:
9+ https://cwiki.apache.org/confluence/display/HTTPD/DistrosDefaultLayout#DistrosDefaultLayout-Debian,Ubuntu(Apachehttpd2.x):
10+.. _README.Debian:
11+ https://salsa.debian.org/apache-team/apache2/raw/master/debian/apache2.README.Debian
12+.. _Apache Arch Linux:
13+ https://wiki.archlinux.org/index.php/Apache_HTTP_Server
14+.. _Apache Fedora:
15+ https://docs.fedoraproject.org/en-US/quick-docs/getting-started-with-apache-http-server/index.html
16+.. _Apache directives:
17+ https://httpd.apache.org/docs/trunk/mod/directives.html
18+.. _Getting Started:
19+ https://httpd.apache.org/docs/current/en/getting-started.html
20+.. _Terms Used to Describe Directives:
21+ https://httpd.apache.org/docs/current/en/mod/directive-dict.html
22+.. _Configuration Files:
23+ https://httpd.apache.org/docs/current/en/configuring.html
24+.. _ProxyPreserveHost: https://httpd.apache.org/docs/trunk/mod/mod_proxy.html#proxypreservehost
25+.. _LoadModule:
26+ https://httpd.apache.org/docs/2.4/mod/mod_so.html#loadmodule
27+.. _DocumentRoot:
28+ https://httpd.apache.org/docs/trunk/mod/core.html#documentroot
29+.. _Location:
30+ https://httpd.apache.org/docs/trunk/mod/core.html#location
31+.. _uWSGI Apache support:
32+ https://uwsgi-docs.readthedocs.io/en/latest/Apache.html
33+.. _apache uwsgi:
34+ https://uwsgi-docs.readthedocs.io/en/latest/Apache.html#mod-proxy-uwsgi
35+.. _mod_proxy_uwsgi:
36+ https://uwsgi-docs.readthedocs.io/en/latest/Apache.html#mod-proxy-uwsgi
37+
38+.. sidebar:: further read
39+
40+ - `Apache Arch Linux`_
41+ - `Apache Debian`_ and `README.Debian`_
42+ - `Apache Fedora`_
43+ - `Apache directives`_
1244
1345.. contents:: Contents
1446 :depth: 2
1547 :local:
1648 :backlinks: entry
1749
18−Add wsgi mod
19−============
50+The apache HTTP server
51+======================
52+
53+If Apache_ is not installed, install it now. If apache_ is new to you, the
54+`Getting Started`_, `Configuration Files`_ and `Terms Used to Describe
55+Directives`_ documentation gives first orientation. There is also a list of
56+`Apache directives`_ *to keep in the pocket*.
57+
58+.. tabs::
59+
60+ .. group-tab:: Ubuntu / debian
61+
62+ .. code:: sh
63+
64+ sudo -H apt-get install apache2
65+
66+ .. group-tab:: Arch Linux
67+
68+ .. code:: sh
69+
70+ sudo -H pacman -S apache
71+ sudo -H systemctl enable httpd
72+ sudo -H systemctl start http
73+
74+ .. group-tab:: Fedora / RHEL
75+
76+ .. code:: sh
77+
78+ sudo -H dnf install httpd
79+ sudo -H systemctl enable httpd
80+ sudo -H systemctl start httpd
81+
82+Now at http://localhost you should see any kind of *Welcome* or *Test* page.
83+How this default intro site is configured, depends on the linux distribution
84+(compare `Apache directives`_).
85+
86+.. tabs::
87+
88+ .. group-tab:: Ubuntu / debian
89+
90+ .. code:: sh
91+
92+ less /etc/apache2/sites-enabled/000-default.conf
93+
94+ In this file, there is a line setting the `DocumentRoot`_ directive:
95+
96+ .. code:: apache
97+
98+ DocumentRoot /var/www/html
99+
100+ And the *welcome* page is the HTML file at ``/var/www/html/index.html``.
101+
102+ .. group-tab:: Arch Linux
103+
104+ .. code:: sh
105+
106+ less /etc/httpd/conf/httpd.conf
107+
108+ In this file, there is a line setting the `DocumentRoot`_ directive:
109+
110+ .. code:: apache
111+
112+ DocumentRoot "/srv/http"
113+ <Directory "/srv/http">
114+ Options Indexes FollowSymLinks
115+ AllowOverride None
116+ Require all granted
117+ </Directory>
118+
119+ The *welcome* page of Arch Linux is a page showing directory located at
120+ ``DocumentRoot``. This is *directory* page is generated by the Module
121+ `mod_autoindex <https://httpd.apache.org/docs/2.4/mod/mod_autoindex.html>`_:
122+
123+ .. code:: apache
124+
125+ LoadModule autoindex_module modules/mod_autoindex.so
126+ ...
127+ Include conf/extra/httpd-autoindex.conf
128+
129+ .. group-tab:: Fedora / RHEL
130+
131+ .. code:: sh
132+
133+ less /etc/httpd/conf/httpd.conf
134+
135+ In this file, there is a line setting the ``DocumentRoot`` directive:
136+
137+ .. code:: apache
138+
139+ DocumentRoot "/var/www/html"
140+ ...
141+ <Directory "/var/www">
142+ AllowOverride None
143+ # Allow open access:
144+ Require all granted
145+ </Directory>
146+
147+ On fresh installations, the ``/var/www`` is empty and the *default
148+ welcome page* is shown, the configuration is located at::
149+
150+ less /etc/httpd/conf.d/welcome.conf
151+
152+.. _The Debian Layout:
153+
154+The Debian Layout
155+=================
156+
157+Be aware that the Debian layout is quite different from the standard Apache
158+configuration. For details look at the README.Debian_
159+(``/usr/share/doc/apache2/README.Debian.gz``). Some commands you should know on
160+Debian:
161+
162+* :man:`apache2ctl`: Apache HTTP server control interface
163+* :man:`a2enmod`, :man:`a2dismod`: switch on/off modules
164+* :man:`a2enconf`, :man:`a2disconf`: switch on/off configurations
165+* :man:`a2ensite`, :man:`a2dissite`: switch on/off sites
166+
167+
168+.. _apache searx site:
169+
170+Apache Reverse Proxy
171+====================
172+
173+.. sidebar:: public to the internet?
174+
175+ If your searx instance is public, stop here and first install :ref:`filtron
176+ reverse proxy <filtron.sh>` and :ref:`result proxy morty <morty.sh>`, see
177+ :ref:`installation scripts`. If already done, follow setup: *searx via
178+ filtron plus morty*.
179+
180+To setup a Apache revers proxy you have to enable the *headers* and *proxy*
181+modules and create a `Location`_ configuration for the searx site. In most
182+distributions you have to uncomment the lines in the main configuration file,
183+except in the :ref:`The Debian Layout`.
184+
185+.. tabs::
186+
187+ .. group-tab:: Ubuntu / debian
188+
189+ In the Apache setup, enable headers and proxy modules:
190+
191+ .. code:: sh
192+
193+ sudo -H a2enmod headers
194+ sudo -H a2enmod proxy
195+ sudo -H a2enmod proxy_http
196+
197+ In :ref:`The Debian Layout` you create a ``searx.conf`` with the
198+ ``<Location /searx >`` directive and save this file in the *sites
199+ available* folder at ``/etc/apache2/sites-available``. To enable the
200+ ``searx.conf`` use :man:`a2ensite`:
201+
202+ .. code:: sh
203+
204+ sudo -H a2ensite searx.conf
205+
206+ .. group-tab:: Arch Linux
207+
208+ In the ``/etc/httpd/conf/httpd.conf`` file, activate headers and proxy
209+ modules (LoadModule_):
210+
211+ .. code:: apache
212+
213+ LoadModule headers_module modules/mod_headers.so
214+ LoadModule proxy_module modules/mod_proxy.so
215+ LoadModule proxy_http_module modules/mod_proxy_http.so
216+
217+ .. group-tab:: Fedora / RHEL
218+
219+ In the ``/etc/httpd/conf/httpd.conf`` file, activate headers and proxy
220+ modules (LoadModule_):
221+
222+ .. code:: apache
223+
224+ LoadModule headers_module modules/mod_headers.so
225+ LoadModule proxy_module modules/mod_proxy.so
226+ LoadModule proxy_http_module modules/mod_proxy_http.so
227+
228+.. tabs::
229+
230+ .. group-tab:: searx via filtron plus morty
231+
232+ Use this setup, if your instance is public to the internet, compare
233+ figure: :ref:`architecture <arch public>` and :ref:`installation scripts`.
234+
235+ 1. Configure a reverse proxy for :ref:`filtron <filtron.sh>`, listening on
236+ *localhost 4004* (:ref:`filtron route request`):
237+
238+ .. code:: apache
239+
240+ <Location /searx >
241+
242+ # SetEnvIf Request_URI "/searx" dontlog
243+ # CustomLog /dev/null combined env=dontlog
244+
245+ Require all granted
246+
247+ Order deny,allow
248+ Deny from all
249+ #Allow from fd00::/8 192.168.0.0/16 fe80::/10 127.0.0.0/8 ::1
250+ Allow from all
251+
252+ ProxyPreserveHost On
253+ ProxyPass http://127.0.0.1:4004
254+ RequestHeader set X-Script-Name /searx
255+
256+ </Location>
257+
258+ 2. Configure reverse proxy for :ref:`morty <searx morty>`, listening on
259+ *localhost 3000* (FYI: ``ProxyPreserveHost On`` is already set, see
260+ above):
261+
262+ .. code:: apache
263+
264+ ProxyPreserveHost On
265+
266+ <Location /morty >
267+
268+ # SetEnvIf Request_URI "/morty" dontlog
269+ # CustomLog /dev/null combined env=dontlog
270+
271+ Require all granted
272+
273+ Order deny,allow
274+ Deny from all
275+ #Allow from fd00::/8 192.168.0.0/16 fe80::/10 127.0.0.0/8 ::1
276+ Allow from all
277+
278+ ProxyPass http://127.0.0.1:3000
279+ RequestHeader set X-Script-Name /morty
280+
281+ </Location>
282+
283+ Note that reverse proxy advised to be used in case of single-user or
284+ low-traffic instances. For a fully result proxification add :ref:`morty's
285+ <searx morty>` **public URL** to your :origin:`searx/settings.yml`:
286+
287+ .. code:: yaml
288+
289+ result_proxy:
290+ # replace example.org with your server's public name
291+ url : https://example.org/morty
292+
293+ server:
294+ image_proxy : True
295+
296+uWSGI support
297+=============
298+
299+Be warned, with this setup, your instance isn't :ref:`protected <searx
300+filtron>`. Nevertheless it is good enough for intranet usage and it
301+demonstrates: *how different the uwsgi support is, depending on the
302+distribution*. To enable :ref:`uWSGI <searx uwsgi>` support you need to install
303+the apache `apache uwsgi`_ support:
20304
21305.. tabs::
22306
@@ -27,59 +311,130 @@ Add wsgi mod
27311 sudo -H apt-get install libapache2-mod-uwsgi
28312 sudo -H a2enmod uwsgi
29313
30−Add this configuration in the file ``/etc/apache2/apache2.conf``. To limit
31−acces to your intranet replace ``Allow from all`` directive and replace
32−``192.168.0.0/16`` with your subnet IP/class.
314+ .. group-tab:: Arch Linux
315+
316+ .. code:: sh
317+
318+ sudo -H pacman -S uwsgi
33319
34−.. _inranet apache site:
320+ In the ``/etc/httpd/conf/httpd.conf`` file, activate headers and proxy
321+ modules (LoadModule_):
35322
36−Note that if your instance of searx is not at the root, you should change
37−``<Location />`` by the location of your instance, like ``<Location /searx>``:
323+ .. code:: apache
38324
39−.. code:: apache
325+ LoadModule proxy_module modules/mod_proxy.so
326+ LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
40327
41− # CustomLog /dev/null combined
328+ .. group-tab:: Fedora / RHEL
42329
43− <IfModule mod_uwsgi.c>
330+ .. code:: sh
44331
45− <Location />
332+ sudo -H dnf install uwsgi
333+ FIXME: enable uwsgi in apache
46334
47− Options FollowSymLinks Indexes
48− SetHandler uwsgi-handler
49− uWSGISocket /run/uwsgi/app/searx/socket
335+The next example shows a configuration using the `uWSGI Apache support`_ via
336+unix sockets. For socket communication, you have to activate ``socket =
337+/run/uwsgi/app/searx/socket`` and comment out the ``http = 127.0.0.1:8888``
338+configuration in your :ref:`uwsgi ini file <uwsgi configuration>`.
50339
51− Order deny,allow
52− Deny from all
53− # Allow from fd00::/8 192.168.0.0/16 fe80::/10 127.0.0.0/8 ::1
54− Allow from all
340+If not already exists, create a folder for the unix sockets, which can be
341+used by the searx account:
55342
56− </Location>
343+.. code:: bash
57344
58− </IfModule>
345+ sudo -H mkdir -p /run/uwsgi/app/searx/
346+ sudo -H chown -R searx:searx /run/uwsgi/app/searx/
59347
60−Enable apache mod_uwsgi and restart apache:
348+To limit acces to your intranet replace ``Allow from all`` directive and replace
349+``192.168.0.0/16`` with your subnet IP/class.
61350
62351.. tabs::
63352
64353 .. group-tab:: Ubuntu / debian
65354
66− .. code:: sh
355+ Debian uses the (old) `mod_uwsgi
356+ <https://uwsgi-docs.readthedocs.io/en/latest/Apache.html#mod-uwsgi>`_.
67357
68− a2enmod uwsgi
69− sudo -H systemctl restart apache2
358+ .. code:: apache
70359
71−disable logs
72−============
360+ <IfModule mod_uwsgi.c>
361+
362+ # SetEnvIf Request_URI "/searx" dontlog
363+ # CustomLog /dev/null combined env=dontlog
364+
365+ <Location /searx >
366+
367+ Require all granted
368+
369+ Options FollowSymLinks Indexes
370+ SetHandler uwsgi-handler
371+ uWSGISocket /run/uwsgi/app/searx/socket
372+
373+ Order deny,allow
374+ Deny from all
375+ # Allow from fd00::/8 192.168.0.0/16 fe80::/10 127.0.0.0/8 ::1
376+ Allow from all
377+
378+ </Location>
379+
380+ </IfModule>
381+
382+ .. group-tab:: Arch Linux
383+
384+ Arch Linux uses the (recommend) `mod_proxy_uwsgi`_.
385+
386+ .. code:: apache
387+
388+ <IfModule proxy_uwsgi_module>
389+
390+ # SetEnvIf Request_URI /searx dontlog
391+ # CustomLog /dev/null combined env=dontlog
392+
393+ <Location /searx>
394+
395+ Require all granted
396+ Order deny,allow
397+ Deny from all
398+ # Allow from fd00::/8 192.168.0.0/16 fe80::/10 127.0.0.0/8 ::1
399+ Allow from all
400+
401+ ProxyPreserveHost On
402+ ProxyPass unix:/run/uwsgi/app/searx/socket|uwsgi://uwsgi-uds-searx/
403+
404+ </Location>
405+
406+ </IfModule>
407+
408+ .. group-tab:: Fedora / RHEL
409+
410+ RHEL uses the (recommend) `mod_proxy_uwsgi`_.
73411
74−For better privacy you can disable Apache logs. Go back to
75−``/etc/apache2/apache2.conf`` :ref:`[example] <inranet apache site>` and above
76−``<Location />`` activate directive:
412+ .. code:: apache
77413
78−.. code:: apache
414+ <IfModule proxy_uwsgi_module>
79415
80− CustomLog /dev/null combined
416+ # SetEnvIf Request_URI /searx dontlog
417+ # CustomLog /dev/null combined env=dontlog
81418
82−Restart apache:
419+ <Location /searx>
420+
421+ Require all granted
422+ Order deny,allow
423+ Deny from all
424+ # Allow from fd00::/8 192.168.0.0/16 fe80::/10 127.0.0.0/8 ::1
425+ Allow from all
426+
427+ ProxyPreserveHost On
428+ ProxyPass unix:/run/uwsgi/app/searx/socket|uwsgi://uwsgi-uds-searx/
429+
430+ </Location>
431+
432+ </IfModule>
433+
434+.. _restart apache:
435+
436+Restart service
437+===============
83438
84439.. tabs::
85440
@@ -88,8 +443,33 @@ Restart apache:
88443 .. code:: sh
89444
90445 sudo -H systemctl restart apache2
446+ sudo -H service uwsgi restart searx
447+
448+ .. group-tab:: Arch Linux
449+
450+ .. code:: sh
451+
452+ sudo -H systemctl restart httpd
453+ sudo -H systemctl restart uwsgi@searx
454+
455+ .. group-tab:: Fedora / RHEL
456+
457+ .. code:: sh
458+
459+ sudo -H systemctl restart httpd
460+ sudo -H touch /etc/uwsgi.d/searx.ini
461+
462+
463+disable logs
464+============
465+
466+For better privacy you can disable Apache logs. In the examples above activate
467+one of the lines and `restart apache`_::
468+
91469
92−.. warning::
470+ # SetEnvIf Request_URI "/searx" dontlog
471+ # CustomLog /dev/null combined env=dontlog
93472
94− You can only disable logs for the whole (virtual) server not for a specific
95− path.
473+The ``CustomLog`` directive disable logs for the whole (virtual) server, use it
474+when the URL of the service does not have a path component (``/searx``) / is
475+located at root (``/``).