fix(search): point engine at searxng-internal alias (search_rpc-only) - #70
Merged
Conversation
The engine's docker config used `http://searxng:8080`. `searxng` resolves on BOTH the internal search_rpc network and public_egress; docker DNS returns the public_egress IP, where the egress firewall drops service-to-service traffic — so the answer path's SearXNG fetch fails with "target unreachable" whenever DNS picks that IP. Use the `searxng-internal` alias (search_rpc-only, pinned IP), matching what the SaaS already uses. Engine-only config change.
There was a problem hiding this comment.
Pull request overview
Adjusts the Docker override config for the /v1/search endpoint to target a SearXNG hostname that is intended to resolve only on an internal network, avoiding mis-resolution onto an egress network that drops east-west traffic.
Changes:
- Update
[search].searxng_urlinconfig.docker.tomlfromhttp://searxng:8080tohttp://searxng-internal:8080. - Expand the inline comment to document why the
searxng-internalalias is required in the affected deployment topology.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+76
to
+83
| # /v1/search points at the bundled SearXNG sidecar. Use the `searxng-internal` | ||
| # alias, which exists ONLY on the internal `search_rpc` network — the bare | ||
| # `searxng` name also resolves on `public_egress`, where the egress firewall | ||
| # drops service-to-service traffic, so docker DNS returning that IP breaks the | ||
| # answer path. `searxng-internal` pins the search_rpc IP (matches the SaaS, | ||
| # which already uses it). See crw-saas docker-compose.prod.yml. | ||
| [search] | ||
| searxng_url = "http://searxng:8080" | ||
| searxng_url = "http://searxng-internal:8080" |
This was referenced Jun 1, 2026
us
added a commit
that referenced
this pull request
Jun 5, 2026
config.docker.toml shipped `searxng_url = http://searxng-internal:8080`, a SaaS-only network alias (added in #70) that has no service or alias on the opencore single-bridge compose network. The host never resolved, so /v1/search and the crw_search MCP tool failed for every user of the reference stack. Point it at `searxng:8080` — the actual compose service name — and rewrite the comment to describe the opencore topology and the CRW_SEARCH__SEARXNG_URL override instead of the SaaS rationale.
us
added a commit
that referenced
this pull request
Jun 5, 2026
Parses config.docker.toml and asserts every renderer/search host resolves to a known docker-compose service name. This would have caught the SaaS-only `searxng-internal` host that #70 leaked into the opencore default, and bites on any future drift. Uses the in-tree toml crate (no compose YAML parsing).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Engine config used
http://searxng:8080, which resolves on both the internal search_rpc network and public_egress. Docker DNS returns the public_egress IP, where the egress firewall drops service-to-service traffic — breaking the answer path's SearXNG fetch ("target unreachable") whenever DNS picks that IP. Use thesearxng-internalalias (search_rpc-only, pinned IP), matching the SaaS. Verified live on prod: answer path restored, belgrad → Ambar/Pečat/Iva (Belgrade, Serbia). Engine-only config change.