The file in question can be found here

Ah, I guess I might need to add my RootCA to my phone, laptop, pc huh? That would get rid of the untrusted warnings. Yes, please feel free to share if you have documentation!

Update: I setup my own local CA and got it working. Thanks for the tip!

You’re a legend. Changing SEARXNG_HOSTNAME in my .env file solved it.

Gotcha, that matches my assumptions. Yes everything is internal. It’s accessible remotely via Wireguard, but I mostly wanted to get some practice with NGINX/ TLS certs (also way easier to refer to things around the house with <service>.homelab isntead of IP:port, haha.

So if I did want this to be fully encrypted, I would essentially need to configure each service (jellyfin, home assistant, etc) to have SSL on them with this self-signed cert/ key that I used on NGINX (or perhaps new cert/ key) and then I would be all set?

Thanks! The output of the xml is as follows

<OpenSearchDescription>
<ShortName>SearXNG</ShortName>
<LongName>SearXNG metasearch</LongName>
<Description>
SearXNG is a metasearch engine that respects your privacy.
</Description>
<InputEncoding>UTF-8</InputEncoding>
<Image type="image/png">
https://192.168.2.20:8080/static/themes/simple/img/favicon.png?60321eeb6e2f478f0e5704529308c594d5924246
</Image>
<Url rel="results" type="text/html" method="GET" template="https://192.168.2.20:8080/search?q=%7BsearchTerms%7D"/>
<Url rel="suggestions" type="application/x-suggestions+json" method="GET" template="https://192.168.2.20:8080/autocompleter?q=%7BsearchTerms%7D"/>
<Url rel="self" type="application/opensearchdescription+xml" method="GET" template="https://192.168.2.20:8080/opensearch.xml"/>
<Query role="example" searchTerms="SearXNG"/>
<moz:SearchForm>https://192.168.2.20:8080/search</moz:SearchForm>
</OpenSearchDescription>

It looks like it’s set to use https://192.168.2.20:8080/ for some reason. https://search.home/ will resolve fine but using https with the underlying IP will not.

I haven’t. I created this custom cert and uploaded in in NGINX (NGINX itself isn’t using SSL) and applied it to each proxy client, then when I visit one of them it appears to be HTTPS, but I feel that it probably isn’t actually giving me the protections I imagine.

Luckily rebooting the host solved it :) the regularly scheduled 3 AM backups went off this morning without issue.