{"id":2777,"date":"2026-04-06T12:58:57","date_gmt":"2026-04-06T12:58:57","guid":{"rendered":"https:\/\/www.serverspan.com\/blog\/"},"modified":"2026-04-06T12:58:58","modified_gmt":"2026-04-06T12:58:58","slug":"searxng-pe-un-vps-cum-rulezi-cautare-privata-fara-sa-fie-limitata-pana-devine-inutila","status":"publish","type":"post","link":"https:\/\/www.serverspan.ro\/blog\/searxng-pe-un-vps-cum-rulezi-cautare-privata-fara-sa-fie-limitata-pana-devine-inutila\/","title":{"rendered":"SearXNG pe un VPS: cum rulezi c\u0103utare privat\u0103 f\u0103r\u0103 s\u0103 fie limitat\u0103 p\u00e2n\u0103 devine inutil\u0103"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Dac\u0103 instan\u021ba ta SearXNG merge impecabil \u00een prima s\u0103pt\u0103m\u00e2n\u0103, apoi \u00eencepe s\u0103 \u00eentoarc\u0103 rezultate incomplete, s\u0103 loveasc\u0103 CAPTCHA-uri, s\u0103 piard\u0103 motoare de c\u0103utare pe r\u00e2nd sau s\u0103 se transforme \u00eentr-o interfa\u021b\u0103 frumoas\u0103 care r\u0103spunde prost, problema nu este de obicei lipsa de CPU ori RAM. Problema real\u0103 este disciplina traficului. O instan\u021b\u0103 de c\u0103utare privat\u0103 r\u0103m\u00e2ne util\u0103 doar dac\u0103 trei straturi sunt configurate corect \u00een acela\u0219i timp: traficul utilizatorilor c\u0103tre aplica\u021bie, proxy-ul invers din fa\u021b\u0103 \u0219i traficul de ie\u0219ire c\u0103tre motoarele c\u0103utate \u00een amonte. Dac\u0103 unul dintre aceste straturi este tratat superficial, instan\u021ba ta ajunge limitat\u0103 p\u00e2n\u0103 devine aproape inutil\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Modelul s\u0103n\u0103tos pentru produc\u021bie este simplu. \u021aii instan\u021ba privat\u0103 \u00een mod implicit. Transmi\u021bi corect IP-ul real al clientului prin proxy. Activezi limiterul SearXNG \u00eempreun\u0103 cu Valkey. Pui re\u021belele tale de \u00eencredere pe list\u0103 de excep\u021bii \u00een loc s\u0103 dezactivezi protec\u021bia complet. \u021aii lista de motoare c\u00e2t mai supl\u0103. Reduci agresiv ritmul c\u00e2nd furnizorii din amonte \u00eencep s\u0103 r\u0103spund\u0103 cu bloc\u0103ri sau CAPTCHA. Dac\u0103 ai mai multe ie\u0219iri legitime c\u0103tre internet, le folose\u0219ti controlat. Dac\u0103 nu le ai, \u00eencetezi s\u0103 te compor\u021bi ca \u0219i cum un singur IP public de VPS poate sus\u021bine la nesf\u00e2r\u0219it un gateway de metac\u0103utare pentru orice fel de trafic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce face de obicei o instan\u021b\u0103 SearXNG s\u0103 devin\u0103 inutil\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cele mai multe instal\u0103ri e\u0219uate de SearXNG nu mor pentru c\u0103 aplica\u021bia ar fi slab\u0103. Mor pentru c\u0103 operatorul o trateaz\u0103 ca pe un site static cu o c\u0103su\u021b\u0103 de c\u0103utare pus\u0103 deasupra.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Proxy-ul invers transmite gre\u0219it IP-ul clientului, astfel \u00eenc\u00e2t to\u021bi utilizatorii par s\u0103 fie chiar proxy-ul.<\/li>\n\n\n\n<li>Limiterul este dezactivat, configurat prost sau nu are Valkey, iar traficul abuziv ajunge s\u0103 loveasc\u0103 din acela\u0219i IP public toate motoarele din amonte.<\/li>\n\n\n\n<li>Instan\u021ba este expus\u0103 mai larg dec\u00e2t ai fi dispus s\u0103 recuno\u0219ti, dar este tratat\u0103 ca \u0219i cum ar fi doar pentru uz privat.<\/li>\n\n\n\n<li>Sunt activate prea multe motoare, iar o singur\u0103 c\u0103utare se \u00eempr\u0103\u0219tie \u00een prea multe cereri de ie\u0219ire.<\/li>\n\n\n\n<li>C\u00e2nd apar r\u0103spunsuri de tip access denied sau CAPTCHA, instan\u021ba continu\u0103 s\u0103 insiste \u00een loc s\u0103 se retrag\u0103.<\/li>\n\n\n\n<li>VPS-ul are un singur traseu de ie\u0219ire, dar este folosit de parc\u0103 ar sus\u021bine f\u0103r\u0103 probleme un serviciu public masiv.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A\u0219a apare tiparul clasic: \u00een prima lun\u0103 pare excelent, \u00een a doua devine enervant, iar \u00een a treia nu mai ai \u00eencredere \u00een el.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prima regul\u0103: hot\u0103r\u0103\u0219te dac\u0103 instan\u021ba ta este cu adev\u0103rat privat\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SearXNG face o distinc\u021bie pe care mul\u021bi o ignor\u0103 prea u\u0219or. O instan\u021b\u0103 privat\u0103 \u0219i una public\u0103 nu trebuie tratate la fel. \u00cen set\u0103ri, <code>public_instance: true<\/code> activeaz\u0103 comportamente suplimentare g\u00e2ndite special pentru instan\u021be publice. Dac\u0103 \u00ee\u021bi construie\u0219ti un motor de c\u0103utare pentru tine, pentru familie, pentru birou sau pentru utilizatori care intr\u0103 doar prin VPN, nu-l trata ca pe o instan\u021b\u0103 public\u0103 doar pentru c\u0103 este vizibil\u0103 pe internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Asta nu \u00eenseamn\u0103 c\u0103 o la\u0219i neprotejat\u0103. \u00censeamn\u0103 c\u0103 \u00eencetezi s\u0103 te min\u021bi singur c\u0103 \u201ee public\u0103, dar doar oamenii mei \u0219tiu adresa\u201d ar fi acela\u0219i lucru cu \u201ee privat\u0103\u201d. Nu este.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un punct de plecare s\u0103n\u0103tos \u00een <code>settings.yml<\/code> arat\u0103 a\u0219a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server:\n  secret_key: \"inlocuieste-cu-o-cheie-reala\"\n  limiter: true\n  public_instance: false\n\nvalkey:\n  url: valkey:\/\/127.0.0.1:6379\/0<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Asta face dou\u0103 lucruri importante. \u021aine limiterul activ \u0219i evit\u0103 activarea unui comportament de instan\u021b\u0103 public\u0103 de care nu ai nevoie pe un serviciu privat autentic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 vrei hostul potrivit pentru o asemenea aplica\u021bie, un <a href=\"https:\/\/www.serverspan.ro\/virtual-servers\">VPS KVM cu acces root complet<\/a> este alegerea corect\u0103. Acesta nu este genul de serviciu pe care \u00eel pui \u00eentr-un mediu constr\u00e2ns \u0219i speri c\u0103 stratul de re\u021bea se va comporta frumos de la sine.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A doua regul\u0103: proxy-ul invers trebuie s\u0103 spun\u0103 adev\u0103rul despre client<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aici apare una dintre cele mai frecvente defec\u021biuni t\u0103cute. Limiterul SearXNG identific\u0103 clien\u021bii dup\u0103 IP. Dac\u0103 proxy-ul \u00eei transmite date gre\u0219ite despre client, limiterul devine inutil sau chiar d\u0103un\u0103tor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 toate cererile par s\u0103 vin\u0103 de la proxy, un singur utilizator ner\u0103bd\u0103tor poate declan\u0219a limit\u0103ri pentru toat\u0103 lumea. Iar dac\u0103 mai adaugi \u0219i limitare \u00een NGINX f\u0103r\u0103 s\u0103 repari mai \u00eent\u00e2i IP-ul real, doar dublezi prostia.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pentru NGINX \u00een fa\u021ba lui SearXNG pe un subdomeniu dedicat, partea critic\u0103 este simpl\u0103:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>server {\n    listen 443 ssl http2;\n    server_name search.example.com;\n\n    ssl_certificate     \/etc\/letsencrypt\/live\/search.example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/search.example.com\/privkey.pem;\n\n    location \/ {\n        proxy_pass http:\/\/127.0.0.1:8080;\n\n        proxy_set_header Host              $host;\n        proxy_set_header Connection        $http_connection;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header X-Real-IP         $remote_addr;\n        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 montezi SearXNG sub o subcale \u00een loc de un subdomeniu dedicat, mai ai nevoie \u0219i de <code>X-Script-Name<\/code>. Sfatul opera\u021bional este totu\u0219i mai simplu: evit\u0103 subc\u0103ile dac\u0103 po\u021bi. Un subdomeniu dedicat este mai u\u0219or de \u00een\u021beles \u0219i mai greu de stricat.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 \u0219i NGINX este \u00een spatele altui proxy sau al unui load balancer, repar\u0103 mai \u00eent\u00e2i IP-ul real al clientului \u00eenainte s\u0103 adaugi limit\u0103ri pe IP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set_real_ip_from 10.0.0.0\/8;\nset_real_ip_from 192.168.0.0\/16;\nreal_ip_header X-Forwarded-For;\nreal_ip_recursive on;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">F\u0103r\u0103 asta, orice limitare per IP este doar teatru.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A treia regul\u0103: limiterul SearXNG nu este op\u021bional pe o instan\u021b\u0103 expus\u0103 pe internet<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Documenta\u021bia SearXNG este foarte clar\u0103 aici. Aplica\u021bia trimite interog\u0103rile mai departe c\u0103tre motoare externe. Asta \u00eenseamn\u0103 c\u0103 traficul abuziv \u00eempotriva instan\u021bei tale se transform\u0103 \u00een trafic abuziv din IP-ul serverului t\u0103u c\u0103tre acele motoare. Rezultatul este previzibil. IP-ul serverului este tratat ca surs\u0103 suspect\u0103, prime\u0219te CAPTCHA sau este blocat direct.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Limiterul exist\u0103 exact ca s\u0103 opreasc\u0103 aceast\u0103 spiral\u0103 \u00eenainte ca motoarele din amonte s\u0103 te pedepseasc\u0103. Dar limiterul are nevoie de Valkey. F\u0103r\u0103 el, lipse\u0219te tocmai componenta menit\u0103 s\u0103 \u00eempiedice un singur client prost sau abuziv s\u0103 compromit\u0103 instan\u021ba \u00eentreag\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">O configura\u021bie minim\u0103 \u0219i s\u0103n\u0103toas\u0103 \u00een <code>\/etc\/searxng\/limiter.toml<\/code> ar trebui s\u0103 defineasc\u0103 m\u0103car proxy-urile de \u00eencredere \u0219i, pentru re\u021belele tale legitime, o list\u0103 de excep\u021bii:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;botdetection]\ntrusted_proxies = &#91;\n  \"127.0.0.0\/8\",\n  \"::1\",\n  \"10.0.0.0\/8\",\n  \"192.168.0.0\/16\",\n]\n\n&#91;botdetection.ip_lists]\npass_ip = &#91;\n  \"10.8.0.0\/24\",\n  \"192.168.1.0\/24\",\n]<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A\u0219a le dai spa\u021biu utilizatorilor t\u0103i de \u00eencredere, cum ar fi cei care intr\u0103 prin VPN sau din LAN. Nu dezactiv\u00e2nd complet protec\u021bia pentru toat\u0103 instan\u021ba.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un detaliu important este c\u0103 logica de detectare a comportamentului abuziv nu trateaz\u0103 toate cererile la fel. Cererile automate \u0219i cele cu profil de API sunt judecate mai sever dec\u00e2t navigarea normal\u0103 \u00een interfa\u021b\u0103. Dac\u0103 at\u00e2rni de instan\u021b\u0103 extensii, scripturi sau integr\u0103ri care lovesc agresiv autocomplete-ul \u0219i c\u0103utarea, po\u021bi declan\u0219a singur exact mecanismele de protec\u021bie pe care apoi le \u00eenjuri.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A patra regul\u0103: limitarea din NGINX ajut\u0103, dar nu \u00eenlocuie\u0219te limiterul din SearXNG<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NGINX poate limita rata de cereri per IP. Este util pentru a opri izbucnirile evidente \u00eenainte s\u0103 ajung\u0103 \u00een aplica\u021bie. Nu este \u00eens\u0103 un substitut pentru limiterul SearXNG, pentru c\u0103 NGINX nu \u0219tie c\u0103tre c\u00e2te motoare va fi \u00eempr\u0103\u0219tiat\u0103 o c\u0103utare \u0219i nici ce tip de presiune genereaz\u0103 fiecare cerere \u00een amonte.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">O protec\u021bie practic\u0103 la intrare poate ar\u0103ta a\u0219a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http {\n    limit_req_zone $binary_remote_addr zone=searxng_search:10m rate=2r\/s;\n\n    server {\n        listen 443 ssl http2;\n        server_name search.example.com;\n\n        location = \/search {\n            limit_req zone=searxng_search burst=8 nodelay;\n\n            proxy_pass http:\/\/127.0.0.1:8080;\n            proxy_set_header Host              $host;\n            proxy_set_header Connection        $http_connection;\n            proxy_set_header X-Forwarded-Proto $scheme;\n            proxy_set_header X-Real-IP         $remote_addr;\n            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n        }\n    }\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Pe o instan\u021b\u0103 privat\u0103, limitarea asta nu trebuie s\u0103 fie exagerat de agresiv\u0103. Scopul ei este s\u0103 opreasc\u0103 izbucnirile stupide, nu s\u0103 transforme propriul t\u0103u motor de c\u0103utare \u00eentr-un obstacol.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A cincea regul\u0103: \u021bine lista de motoare c\u00e2t mai supl\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fiecare motor activat \u00ee\u021bi m\u0103re\u0219te amprenta de trafic c\u0103tre exterior. O singur\u0103 interogare se poate transforma \u00eentr-un pachet mare de cereri dac\u0103 ai activat prea multe surse doar \u201eca s\u0103 fie\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Asta este una dintre cele mai pu\u021bin spectaculoase, dar cele mai eficiente optimiz\u0103ri pentru SearXNG. Fii selectiv. P\u0103streaz\u0103 doar motoarele pe care chiar le folose\u0219ti \u0219i le consideri utile. O instan\u021b\u0103 privat\u0103 de c\u0103utare nu trebuie s\u0103 fie o colec\u021bie complet\u0103 a tuturor conectorilor existen\u021bi.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 anumite motoare trebuie s\u0103 fie disponibile doar pentru utilizatori de \u00eencredere, folose\u0219te mecanismele dedicate din SearXNG pentru asta, \u00een loc s\u0103 le expui tuturor permanent.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A \u0219asea regul\u0103: trateaz\u0103 traficul de ie\u0219ire ca pe o decizie de arhitectur\u0103<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Multe ghiduri despre SearXNG discut\u0103 aproape exclusiv traficul de intrare \u0219i spun foarte pu\u021bin despre cel de ie\u0219ire. Este exact invers fa\u021b\u0103 de ce conteaz\u0103 \u00een practic\u0103. Utilitatea real\u0103 a instan\u021bei tale depinde enorm de modul \u00een care iese spre motoarele externe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SearXNG suport\u0103 proxy-uri de ie\u0219ire \u0219i alegerea explicit\u0103 a adreselor surs\u0103. Dac\u0103 ai mai multe trasee legitime de ie\u0219ire, cererile pot fi distribuite \u00eentre ele, iar re\u00eencerc\u0103rile pot folosi alt traseu. Asta ajut\u0103 atunci c\u00e2nd unul dintre furnizorii din amonte \u00eencepe s\u0103 considere un singur IP prea zgomotos sau suspect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Un exemplu practic arat\u0103 a\u0219a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>outgoing:\n  request_timeout: 4.0\n  retries: 1\n  source_ips:\n    - 198.51.100.10\n    - 2001:db8:10::10\n  proxies:\n    https:\n      - socks5:\/\/127.0.0.1:9050\n      - socks5:\/\/127.0.0.1:9051\n  useragent_suffix: \"contact: admin@example.com\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Folose\u0219te asta responsabil. Mai multe adrese surs\u0103 sau mai multe proxy-uri sunt un mecanism de rezilien\u021b\u0103 pentru o instan\u021b\u0103 privat\u0103 legitim\u0103. Nu sunt o invita\u021bie s\u0103 transformi un VPS \u00eentr-o ferm\u0103 de scraping. Dac\u0103 \u00eempingi mai tare \u00een amonte, tot blocat ajungi. Doar ceva mai distribuit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detaliul cu <code>useragent_suffix<\/code> merit\u0103 men\u021bionat. Dac\u0103 pui acolo o informa\u021bie de contact real\u0103, unele bloc\u0103ri devin mai u\u0219or de \u00een\u021beles sau de tratat. Nu este o garan\u021bie, dar este mai bine dec\u00e2t s\u0103 apari ca o cutie neagr\u0103 anonim\u0103.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A \u0219aptea regul\u0103: c\u00e2nd motoarele din amonte \u00eencep s\u0103 se pl\u00e2ng\u0103, te retragi<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 un motor \u00eencepe s\u0103 r\u0103spund\u0103 cu access denied sau CAPTCHA, nu continua s\u0103-l love\u0219ti ca un script \u00eenc\u0103p\u0103\u021b\u00e2nat. SearXNG ofer\u0103 deja mecanisme de retragere temporar\u0103. Folose\u0219te-le.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Set\u0103rile de c\u0103utare permit suspendarea temporar\u0103 a motoarelor dup\u0103 e\u0219ecuri, iar valorile pentru <code>SearxEngineAccessDenied<\/code> \u0219i <code>SearxEngineCaptcha<\/code> sunt severe tocmai pentru c\u0103 au sens. C\u00e2nd un furnizor \u021bi-a provocat deja IP-ul cu o provocare de tip CAPTCHA, mai multe \u00eencerc\u0103ri nu sunt curaj. Sunt autosabotaj.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>search:\n  ban_time_on_fail: 5\n  max_ban_time_on_fail: 120\n  suspended_times:\n    SearxEngineAccessDenied: 86400\n    SearxEngineCaptcha: 86400<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Po\u021bi ajusta valorile, dar principiul r\u0103m\u00e2ne acela\u0219i: o instan\u021b\u0103 s\u0103n\u0103toas\u0103 \u0219tie s\u0103 se retrag\u0103 atunci c\u00e2nd motoarele surs\u0103 \u00eencep s\u0103 resping\u0103 traficul.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce faci c\u00e2nd IP-ul VPS-ului este deja provocat cu CAPTCHA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dup\u0103 ce un motor \u021bi-a aruncat deja un CAPTCHA c\u0103tre IP-ul serverului, ai dou\u0103 sarcini. Prima este s\u0103 opre\u0219ti comportamentul care te-a adus acolo. A doua este s\u0103 cure\u021bi provocarea pentru identitatea public\u0103 a acelui IP, dac\u0103 furnizorul \u00ee\u021bi permite asta.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SearXNG documenteaz\u0103 o metod\u0103 practic\u0103 pentru acest caz printr-un tunel SOCKS peste SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -q -N -D 8080 user@vps-ul-tau.example.com<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Apoi \u00ee\u021bi configurezi browserul s\u0103 ias\u0103 prin <code>socks5:\/\/127.0.0.1:8080<\/code>, verifici c\u0103 folose\u0219te IP-ul serverului \u0219i rezolvi CAPTCHA-ul ca \u0219i cum ai fi chiar serverul. Asta este prim ajutor, nu strategie pe termen lung. Dac\u0103 nu repari cauza, provocarea revine.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Arhitectura pe care chiar am avea \u00eencredere s\u0103 o l\u0103s\u0103m \u00een produc\u021bie<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pentru o instan\u021b\u0103 privat\u0103 SearXNG care trebuie s\u0103 r\u0103m\u00e2n\u0103 util\u0103 \u0219i peste c\u00e2teva luni, configura\u021bia de baz\u0103 pe care am considera-o s\u0103n\u0103toas\u0103 este aceasta:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Debian 12 sau Ubuntu 24.04<\/li>\n\n\n\n<li>SearXNG \u00een Docker Compose sau instalare nativ\u0103 curat\u0103<\/li>\n\n\n\n<li>Valkey local pe acela\u0219i host<\/li>\n\n\n\n<li>NGINX \u00een fa\u021b\u0103, cu IP real transmis corect<\/li>\n\n\n\n<li>un subdomeniu dedicat, de exemplu <code>search.example.com<\/code><\/li>\n\n\n\n<li>o list\u0103 mic\u0103 \u0219i atent aleas\u0103 de motoare<\/li>\n\n\n\n<li>limiter activ, iar lista de excep\u021bii rezervat\u0103 doar re\u021belelor cu adev\u0103rat de \u00eencredere<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Nu este o arhitectur\u0103 spectaculoas\u0103. Perfect. Infrastructura pentru c\u0103utare privat\u0103 ar trebui s\u0103 fie lini\u0219tit\u0103 \u0219i previzibil\u0103, nu \u201ecreativ\u0103\u201d.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 ridici un stack self-hosted mai mare pe acela\u0219i host, merit\u0103 s\u0103 cite\u0219ti \u0219i <a href=\"https:\/\/www.serverspan.ro\/blog\/gestionarea-docker-si-a-containerelor-pe-un-vps-cele-mai-bune-practici-pentru-stabilitate-si-performanta\/\">gestionarea Docker \u0219i a containerelor pe un VPS<\/a>. Dac\u0103 \u00eenc\u0103 \u00ee\u021bi proiectezi hostul \u0219i nu ai ajuns la faza de \u00eent\u0103rire opera\u021bional\u0103, <a href=\"https:\/\/www.serverspan.ro\/blog\/ghid-self-hosting-pentru-website-in-2026-setup-si-arhitectura-aompleta-pentru-incepatori\/\">ghidul de self-hosting pentru website \u00een 2026<\/a> este complementul bun la nivel de infrastructur\u0103. Iar dac\u0103 vrei mediul potrivit pentru aceast\u0103 clas\u0103 de aplica\u021bii \u00eenc\u0103 de la \u00eenceput, <a href=\"https:\/\/www.serverspan.ro\/virtual-servers\">serverele virtuale ServerSpan<\/a> sunt pagina-p\u0103rinte corect\u0103 pentru articolul \u0103sta, pentru c\u0103 \u00ee\u021bi dau exact stratul de control de care aceast\u0103 aplica\u021bie are nevoie.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Checklist c\u00e2nd instan\u021ba \u00eencepe s\u0103 se degradeze<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Verific\u0103 dac\u0103 proxy-ul invers transmite corect IP-ul real al clientului.<\/li>\n\n\n\n<li>Verific\u0103 dac\u0103 limiterul este activ \u0219i dac\u0103 Valkey r\u0103spunde cu adev\u0103rat.<\/li>\n\n\n\n<li>Verific\u0103 dac\u0103 proxy-urile de \u00eencredere sunt definite corect \u00een <code>limiter.toml<\/code>.<\/li>\n\n\n\n<li>Verific\u0103 dac\u0103 re\u021belele tale private sau VPN-ul sunt pe lista de excep\u021bii, dac\u0103 asta \u00ee\u021bi dore\u0219ti pentru ele.<\/li>\n\n\n\n<li>Elimin\u0103 motoarele pe care nu le folose\u0219ti.<\/li>\n\n\n\n<li>Vezi dac\u0103 motoarele din amonte sunt deja suspendate din cauza CAPTCHA-urilor sau a bloc\u0103rilor.<\/li>\n\n\n\n<li>Dac\u0103 folose\u0219ti mai multe ie\u0219iri c\u0103tre internet, verific\u0103 dac\u0103 sunt folosite cu adev\u0103rat.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Primele comenzi care merit\u0103 rulate sunt banale, dar utile:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -I https:\/\/search.example.com\/\ndocker compose ps\ndocker compose logs --tail 200 searxng\nredis-cli ping\nvalkey-cli ping<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 limiterul este \u201eactiv\u201d doar pe h\u00e2rtie, dar Valkey lipse\u0219te, este configurat pe adresa gre\u0219it\u0103 sau nu r\u0103spunde, instan\u021ba ta doar mimeaz\u0103 protec\u021bia.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">R\u0103spunsul practic<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">C\u0103utarea privat\u0103 pe un VPS nu devine inutil\u0103 pentru c\u0103 SearXNG ar fi defect. Devine inutil\u0103 pentru c\u0103 operatorii ignor\u0103 exact disciplina de trafic de care depinde. Dac\u0103 proxy-ul minte despre IP-ul clientului, limiterul nu te poate proteja corect. Dac\u0103 limiterul nu are Valkey, nu poate face ceea ce a fost construit s\u0103 fac\u0103. Dac\u0103 lista de motoare este umflat\u0103, amprenta ta de trafic cre\u0219te f\u0103r\u0103 motiv. Dac\u0103 ignori semnalele de tip access denied \u0219i CAPTCHA, \u00ee\u021bi consumi singur reputa\u021bia IP-ului serverului.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ruleaz\u0103 SearXNG ca pe un serviciu privat, nu ca pe o poart\u0103 hobby expus\u0103 internetului cu set\u0103ri optimiste. \u021aine proxy-ul sincer. \u021aine limiterul real. \u021aine lista de motoare scurt\u0103. Trateaz\u0103 traficul de ie\u0219ire ca pe parte din design. A\u0219a r\u0103m\u00e2ne util\u0103 c\u0103su\u021ba ta de c\u0103utare, \u00een loc s\u0103 se transforme \u00eentr-o interfa\u021b\u0103 frumoas\u0103 \u00een care motoarele externe nu mai au \u00eencredere.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dac\u0103 instan\u021ba ta SearXNG merge impecabil \u00een prima s\u0103pt\u0103m\u00e2n\u0103, apoi \u00eencepe s\u0103 \u00eentoarc\u0103 rezultate incomplete, s\u0103 loveasc\u0103 CAPTCHA-uri, s\u0103 piard\u0103 motoare de c\u0103utare pe r\u00e2nd sau s\u0103 se transforme \u00eentr-o interfa\u021b\u0103 frumoas\u0103 care r\u0103spunde prost, problema nu este de obicei lipsa de CPU ori RAM. Problema real\u0103 este disciplina traficului. O instan\u021b\u0103 de c\u0103utare privat\u0103 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2775,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,12],"tags":[15470,15468,15467,15453,15471,15462,15446,15472,15461,15466,15451,15458,15432,15442,15457,15438,15437,15459,15441,15460,15440,15427,15464,15463,15445,15428,15429,15431,15465,15469],"class_list":["post-2777","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","category-virtual-servers","tag-kvm-vps-pentru-searxng","tag-metacautare-privata","tag-motor-de-cautare-privat-pe-vps","tag-nginx-limit_req","tag-nginx-real-ip","tag-searxng-access-denied","tag-searxng-ban_time_on_fail","tag-searxng-blocat-de-motoare-externe","tag-searxng-captcha","tag-searxng-cautare-privata","tag-searxng-docker-compose","tag-searxng-limitare-trafic","tag-searxng-limiter","tag-searxng-limiter-toml","tag-searxng-nginx","tag-searxng-outgoing-proxies","tag-searxng-pass_ip","tag-searxng-pe-vps","tag-searxng-private-instance","tag-searxng-proxy-invers","tag-searxng-public_instance","tag-searxng-reverse-proxy-rate-limit","tag-searxng-source_ips","tag-searxng-suspendare-motoare","tag-searxng-trusted_proxies","tag-searxng-valkey","tag-searxng-x-forwarded-for","tag-searxng-x-real-ip","tag-self-hosted-search-engine","tag-vps-pentru-searxng"],"_links":{"self":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2777"}],"version-history":[{"count":1,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2777\/revisions"}],"predecessor-version":[{"id":2778,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2777\/revisions\/2778"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/media\/2775"}],"wp:attachment":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}