{ pkgs, ... }:
{
  services.searx = {
    enable = true;
    package = pkgs.searxng;
    redisCreateLocally = true;
    settings = {
      general = {
        debug = false;
        instance_name = "SearXNG";
      };
      server = {
        bind_address = "127.0.0.1";
        port = 8080;
        base_url = "https://searx.nekover.se";
        limiter = true;
        image_proxy = true;
        secret_key = "@SEARX_SECRET_KEY@";
      };
      search = {
        safe_search = 0;
        autocomplete = "duckduckgo";
      };
      ui.static_use_hash = true;
      enabled_plugins = [ "Hash plugin" "Self Informations" "Tracker URL remover" "Ahmia blacklist" ];
    };
    environmentFile = "/run/secrets/searx-secret-key";
  };

  sops.secrets."searx-secret-key" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "searx.service" ];
  };
}