fix(searxng,seafile): repair wget healthcheck argv, restore seafile after 3-month outage
searxng: the healthcheck passed '--tries' and '--spider' as separate argv entries, so wget consumed '--spider' as the value of '--tries'. Spider mode never engaged and every 30s probe downloaded the response to disk; the container's working directory had accumulated 295,287 healthz.N files since April, and the directory scan to pick the next free filename is what intermittently blew the 10s timeout and flapped the dashboard card to UNHEALTHY. Restored '--tries=1'. The junk was in the writable layer, so the recreate cleared it. Now healthy, fails=0, 200 in 0.16s. seafile: none of the three services declared a restart policy, so Docker defaulted them to 'no'. The daemon stopped all three within 200ms on 2026-05-06 and nothing brought them back — a three-month outage whose only trace was an EXITED card. Exit 255 is what a container ignoring SIGTERM reports when the daemon stops it, not a crash. Added restart: unless-stopped. Stack is back up; mysql gates on its healthcheck as designed and seahub started without the race. 302 -> login page. Both stacks were running unmanaged on ana-docker and are now tracked here. homepage: AI tab reordered by clickability per operator — chat frontends, ComfyUI and the control plane on top; vLLM /docs seats and TTS endpoints below. Corrects the previous commit's UNRESOLVED tab-bar section: it was warm-up time after a recreate, not a defect.
This commit is contained in:
@@ -0,0 +1,88 @@
|
||||
services:
|
||||
searxng:
|
||||
image: searxng/searxng:latest
|
||||
container_name: searxng
|
||||
restart: unless-stopped
|
||||
# ------------------------------------------------------------------
|
||||
# Port binding — 9996 on all interfaces.
|
||||
# Change to "127.0.0.1:9996:8080" to restrict to localhost only.
|
||||
# Traefik handles public routing and TLS via the labels below.
|
||||
# ------------------------------------------------------------------
|
||||
ports:
|
||||
- 9996:8080
|
||||
# ------------------------------------------------------------------
|
||||
# Volumes
|
||||
# Config: settings.yml bind-mounted read-only into the container.
|
||||
volumes:
|
||||
- /opt/docker/conf/searxng/searxng-settings.yml:/etc/searxng/settings.yml:ro
|
||||
# ------------------------------------------------------------------
|
||||
# Environment — see https://docs.searxng.org/admin/settings/index.html
|
||||
# SEARXNG_SECRET — required for cryptographic signing (cookies, etc.)
|
||||
# BASE_URL — public URL SearXNG reports in pages/RSS/OPDS
|
||||
# INSTANCE_NAME — shown in the page title / footer
|
||||
# ------------------------------------------------------------------
|
||||
environment:
|
||||
- SEARXNG_SECRET=${SEARXNG_SECRET}
|
||||
- BASE_URL=https://searxng.pfi.local/
|
||||
- INSTANCE_NAME=SearXNG
|
||||
# ------------------------------------------------------------------
|
||||
# Resource limits — tune for VM 102's available RAM/CPU
|
||||
# ------------------------------------------------------------------
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: 512M
|
||||
cpus: "1.0"
|
||||
reservations:
|
||||
memory: 128M
|
||||
# ------------------------------------------------------------------
|
||||
# Health check — SearXNG /healthz is the canonical liveness probe.
|
||||
#
|
||||
# ⚠️ `--tries=1` MUST keep its `=1`. This read `- --tries` / `- --spider`
|
||||
# as two separate argv entries until 2026-08-18, and in that form wget
|
||||
# consumed `--spider` as the VALUE of `--tries` — so spider mode never
|
||||
# engaged and every probe DOWNLOADED the response to a file instead of
|
||||
# just checking it. By the time it was caught the container's working
|
||||
# directory held 295,287 `healthz.N` files, one per probe since April,
|
||||
# and wget had to scan all of them to pick the next free filename. That
|
||||
# scan is what intermittently blew the 10s timeout and made the card on
|
||||
# the dashboard flap UNHEALTHY while the service itself was fine. It was
|
||||
# self-worsening: every probe made the next one slower.
|
||||
#
|
||||
# The junk lived in the container's writable layer (the only volume here
|
||||
# is the read-only settings mount), so recreating the container cleared
|
||||
# it. Symptom to watch for if this regresses: `docker exec searxng ls |
|
||||
# wc -l` climbing, and health log entries reading
|
||||
# "Health check exceeded timeout (10s)".
|
||||
# ------------------------------------------------------------------
|
||||
healthcheck:
|
||||
test:
|
||||
- CMD
|
||||
- wget
|
||||
- --no-verbose
|
||||
- --tries=1
|
||||
- --spider
|
||||
- http://localhost:8080/healthz
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 15s
|
||||
networks:
|
||||
- tnet
|
||||
labels:
|
||||
# Traefik configuration — auto-discovery via Docker provider
|
||||
- traefik.enable=true
|
||||
- traefik.http.routers.searxng.rule=Host(`searxng.pfi.local`)
|
||||
- traefik.http.routers.searxng.entrypoints=websecure
|
||||
- traefik.http.routers.searxng.tls=true
|
||||
- traefik.http.routers.searxng.service=searxng
|
||||
- traefik.http.services.searxng.loadbalancer.server.port=8080
|
||||
- homepage.group=Apps
|
||||
- homepage.name=SearXNG
|
||||
- homepage.icon=si-searxng
|
||||
- homepage.description=Privacy-respecting meta-search
|
||||
- homepage.href=http://10.250.50.70:9996
|
||||
networks:
|
||||
tnet:
|
||||
name: traefik-net
|
||||
external: true
|
||||
@@ -0,0 +1,73 @@
|
||||
# =============================================================================
|
||||
# SearXNG Custom Settings — overrides defaults from the container image
|
||||
# Full reference: https://docs.searxng.org/admin/settings/index.html
|
||||
# =============================================================================
|
||||
|
||||
use_default_settings:
|
||||
engines:
|
||||
remove:
|
||||
- wikidata
|
||||
- ahmia
|
||||
- torch
|
||||
- karmasearch
|
||||
- karmasearch.videos
|
||||
- brave
|
||||
- brave.images
|
||||
- brave.news
|
||||
- brave.videos
|
||||
|
||||
general:
|
||||
instance_name: "SearXNG"
|
||||
instance_about_url: false
|
||||
contact_url: false
|
||||
debug: false
|
||||
# Disable public metrics page (/stats/errors) to reduce attack surface
|
||||
enable_metrics: false
|
||||
|
||||
search:
|
||||
safe_search: 0
|
||||
# "" disables; "duckduckgo" is the most private working option
|
||||
autocomplete: ""
|
||||
default_lang: "auto"
|
||||
formats:
|
||||
- html
|
||||
- json
|
||||
# 3s is too tight; 8s covers slower engines without hanging the UI
|
||||
request_timeout: 8.0
|
||||
# Ban time after an engine raises a suspended-time exception (default 86400)
|
||||
ban_time_on_fail: 60
|
||||
max_ban_time_on_fail: 600
|
||||
|
||||
server:
|
||||
# REQUIRED. Generate with: openssl rand -hex 32
|
||||
# Prefer setting SEARXNG_SECRET in docker-compose and letting the entrypoint
|
||||
# substitute it; hardcoding a real secret here is a leak risk.
|
||||
#secret_key: "changeme_please_generate_a_secret"
|
||||
bind_address: "0.0.0.0"
|
||||
port: 8080
|
||||
# Enable ONLY if you ship a limiter.toml AND your proxy forwards X-Real-IP.
|
||||
# Otherwise you'll get "X-Forwarded-For nor X-Real-IP header is set!" noise.
|
||||
limiter: false
|
||||
# Mark as true if instance is internet-facing; tightens some defaults.
|
||||
public_instance: false
|
||||
base_url: "https://searxng.pfi.local/"
|
||||
# Allow only GET to the search endpoint (simpler, works with most clients)
|
||||
method: "GET"
|
||||
compression: true
|
||||
# Set to true if you need image_proxy rewriting for privacy
|
||||
image_proxy: false
|
||||
|
||||
# Outgoing HTTP pool — tuned for a low-traffic private instance.
|
||||
# Defaults are fine for most, but these reduce memory use and tighten timeouts.
|
||||
outgoing:
|
||||
request_timeout: 6.0
|
||||
max_request_timeout: 12.0
|
||||
pool_connections: 100
|
||||
pool_maxsize: 20
|
||||
enable_http2: true
|
||||
# Uncomment if you want to route outbound traffic via Tor for .onion engines
|
||||
# proxies:
|
||||
# all://:
|
||||
# - socks5h://tor:9050
|
||||
|
||||
|
||||
Reference in New Issue
Block a user