make repo compatible with http-only upstream TLS

.env

@@ -2,7 +2,6 @@
 # To change this:
 # * uncomment SEARX_HOSTNAME, and replace <host> by the searx hostname
 # * uncomment LETSENCRYPT_EMAIL, and replace <email> by your email (require to create a Let's Encrypt certificate)
-
 # SEARX_HOSTNAME=<host>
 # LETSENCRYPT_EMAIL=<email>
 
@@ -12,3 +11,12 @@ SEARX_COMMAND=-f
 
 # use openssl rand -base64 33
 MORTY_KEY=ReplaceWithARealKey!
+
+# HTTP-only section (for TLS termination upstream via reverse proxy)
+# * Useful if the host machine already has ports 80/443 bound
+# * Be sure to also comment out in the Caddy file & docker-compose.yaml:
+# *    #Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+# *    #- "${SEARX_HTTPS_PORT:-443}:443"
+# PROTOCOL_OVERRIDE=http://
+# SEARX_PORT=8080
+# SEARX_HTTPS_PORT=8443

Caddyfile

@@ -2,7 +2,7 @@
   admin off
 }
 
-{$SEARX_HOSTNAME} {
+{$PROTOCOL_OVERRIDE}{$SEARX_HOSTNAME} {
   log {
         output discard
   }
@@ -44,7 +44,7 @@
         X-Frame-Options "SAMEORIGIN"
 
         # Disable some features
-        Permissions-Policy "accelerometer=();ambient-light-sensor=(); autoplay=();camera=();encrypted-media=();focus-without-user-activation=(); geolocation=();gyroscope=();magnetometer=();microphone=();midi=();payment=();picture-in-picture=(); speaker=();sync-xhr=();usb=();vr=()"
+        Permissions-Policy "accelerometer=(),ambient-light-sensor=(),autoplay=(),camera=(),encrypted-media=(),focus-without-user-activation=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),speaker=(),sync-xhr=(),usb=(),vr=()"
 
         # Disable some features (legacy)
         Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'"
@@ -88,14 +88,14 @@
 
   # Morty
   handle @morty {
-        reverse_proxy localhost:3000
+        reverse_proxy {$PROTOCOL_OVERRIDE}morty:3000
   }
 
   # Filtron
   handle {
         encode zstd gzip
 
-        reverse_proxy localhost:4040 {
+        reverse_proxy {$PROTOCOL_OVERRIDE}filtron:4040 {
                header_up X-Forwarded-Port {http.request.port}
                header_up X-Forwarded-Proto {http.request.scheme}
                header_up X-Forwarded-TlsProto {tls_protocol}

docker-compose.yaml

@@ -6,14 +6,19 @@ services:
     container_name: caddy
     image: caddy:2-alpine
     restart: on-failure
-    network_mode: host
+    networks:
+      - searx
+    ports:
+      - "${SEARX_HTTP_PORT:-80}:80"
+      - "${SEARX_HTTPS_PORT:-443}:443"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caddy-data:/data:rw
       - caddy-config:/config:rw
     environment:
       - SEARX_HOSTNAME=${SEARX_HOSTNAME:-localhost}
       - SEARX_TLS=${LETSENCRYPT_EMAIL:-internal}
+      - PROTOCOL_OVERRIDE=${PROTOCOL_OVERRIDE:-}
     cap_drop:
       - ALL
     cap_add:
@@ -24,11 +29,10 @@ services:
     container_name: filtron
     image: dalf/filtron
     restart: always
-    ports:
-      - "127.0.0.1:4040:4040"
-      - "127.0.0.1:4041:4041"
     networks:
       - searx
+    ports:
+      - 4041:4041
     command: -listen 0.0.0.0:4040 -api 0.0.0.0:4041 -target searx:8080
     volumes:
       - ./rules.json:/etc/filtron/rules.json:rw
@@ -47,8 +51,8 @@ services:
       - ./searx:/etc/searx:rw
     environment:
       - BIND_ADDRESS=0.0.0.0:8080
-      - BASE_URL=https://${SEARX_HOSTNAME:-localhost}/
-      - MORTY_URL=https://${SEARX_HOSTNAME:-localhost}/morty/
+      - BASE_URL=${PROTOCOL_OVERRIDE:-}${SEARX_HOSTNAME}/
+      - MORTY_URL=${PROTOCOL_OVERRIDE:-}${SEARX_HOSTNAME}/morty/
       - MORTY_KEY=${MORTY_KEY}
     cap_drop:
       - ALL
@@ -62,8 +66,6 @@ services:
     container_name: morty
     image: dalf/morty
     restart: always
-    ports:
-      - "127.0.0.1:3000:3000"
     networks:
       - searx
     command: -timeout 6 -ipv6
@@ -76,6 +78,16 @@ services:
     cap_drop:
       - ALL
 
+  searx-checker:
+    container_name: searx-checker
+    image: searx/searx-checker
+    restart: always
+    networks:
+      - searx
+    command: -cron -o html/data/status.json ${PROTOCOL_OVERRIDE:-}searx:8080
+    volumes:
+      - checker-data:/usr/local/searx-checker/html/data
+
 networks:
   searx:
     ipam:
@@ -84,3 +96,4 @@ networks:
 volumes:
   caddy-data:
   caddy-config:
+  checker-data: