typekro 0.7.0 → 0.9.0

package/dist/factories/searxng/resources/searxng.d.ts

@@ -0,0 +1,65 @@
+/**
+ * SearXNG Deployment Factory
+ *
+ * Creates a SearXNG Deployment with a mounted settings ConfigMap,
+ * health probes at /healthz, and optional environment variables.
+ * The secret_key is injected via SEARXNG_SECRET env var (not in ConfigMap).
+ */
+import type { CelExpression, Composable, Enhanced } from '../../../core/types/index.js';
+import { type SearxngConfig, type SearxngStatus } from '../types.js';
+/**
+ * Relaxed spec type for the factory. The ArkType schema constrains
+ * `secretKeyRef.name` and `secretKeyRef.key` to plain strings, but the
+ * bootstrap composition needs to pass `CelExpression<string>` values in
+ * KRO mode (where the field values are CEL ternaries that KRO evaluates
+ * at reconcile time). At runtime `createResource` handles both concrete
+ * strings and CelExpression objects uniformly, so widening the type here
+ * is purely a TypeScript ergonomics fix — no runtime behavior change.
+ */
+type SearxngFactoryConfig = Omit<SearxngConfig, 'spec'> & {
+    spec: Omit<SearxngConfig['spec'], 'secretKeyRef'> & {
+        secretKeyRef?: {
+            name: string | CelExpression<string>;
+            key: string | CelExpression<string>;
+        };
+    };
+};
+/**
+ * Create a SearXNG Deployment resource.
+ *
+ * @example Recommended — mount an existing Secret via `secretKeyRef`
+ * ```typescript
+ * const search = searxng({
+ *   name: 'my-searxng',
+ *   namespace: 'search',
+ *   spec: {
+ *     instanceName: 'My Search',
+ *     search: { formats: ['html', 'json'] },
+ *     server: { limiter: false },
+ *     // Secret is managed externally (Vault, external-secrets operator,
+ *     // or created alongside this factory). The Deployment mounts
+ *     // SEARXNG_SECRET via valueFrom.secretKeyRef — the plaintext
+ *     // never enters the Deployment spec.
+ *     secretKeyRef: { name: 'my-searxng-secret', key: 'secret_key' },
+ *   },
+ * });
+ * ```
+ *
+ * @example Discouraged — plaintext `secret_key` in the config
+ * ```typescript
+ * // Works, but the secret appears in `kubectl get deploy -o yaml` as
+ * // Deployment.spec.template.spec.containers[0].env[].value. Prefer the
+ * // `secretKeyRef` path above or use the `searxngBootstrap` composition
+ * // which auto-creates a K8s Secret and wires it through for you.
+ * const search = searxng({
+ *   name: 'my-searxng',
+ *   spec: {
+ *     server: { secret_key: process.env.SEARXNG_SECRET_KEY!, limiter: false },
+ *   },
+ * });
+ * ```
+ */
+declare function createSearxngResource(config: Composable<SearxngFactoryConfig>): Enhanced<SearxngConfig['spec'], SearxngStatus>;
+export declare const searxng: typeof createSearxngResource;
+export {};
+//# sourceMappingURL=searxng.d.ts.map

package/dist/factories/searxng/resources/searxng.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"searxng.d.ts","sourceRoot":"","sources":["../../../../src/factories/searxng/resources/searxng.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,QAAQ,EAET,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAErB;;;;;;;;GAQG;AACH,KAAK,oBAAoB,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG;IACxD,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG;QAClD,YAAY,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;SACrC,CAAC;KACH,CAAC;CACH,CAAC;AA6BF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,iBAAS,qBAAqB,CAC5B,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC,GACvC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CA6HhD;AAED,eAAO,MAAM,OAAO,8BAAwB,CAAC"}

package/dist/factories/searxng/resources/searxng.js

@@ -0,0 +1,188 @@
+/**
+ * SearXNG Deployment Factory
+ *
+ * Creates a SearXNG Deployment with a mounted settings ConfigMap,
+ * health probes at /healthz, and optional environment variables.
+ * The secret_key is injected via SEARXNG_SECRET env var (not in ConfigMap).
+ */
+import { getComponentLogger } from '../../../core/logging/index.js';
+import { createResource } from '../../shared.js';
+const readinessLogger = getComponentLogger('searxng-readiness');
+import { DEFAULT_SEARXNG_IMAGE, DEFAULT_SEARXNG_PORT, } from '../types.js';
+function searxngReadinessEvaluator(liveResource) {
+    try {
+        const resource = liveResource;
+        const desired = resource.spec?.replicas ?? 1;
+        const ready = resource.status?.readyReplicas ?? 0;
+        if (ready >= desired) {
+            return { ready: true, reason: 'DeploymentReady', message: `${ready}/${desired} replicas ready` };
+        }
+        return { ready: false, reason: 'ReplicasNotReady', message: `${ready}/${desired} replicas ready` };
+    }
+    catch (err) {
+        // Log the underlying error at debug level for diagnosability — the
+        // generic "EvaluationError" message is what the deployment engine
+        // surfaces to the user, but the actual cause (bad shape, type
+        // coercion failure, etc.) is only useful during debugging.
+        readinessLogger.debug('SearXNG readiness evaluation threw', {
+            error: err instanceof Error ? err.message : String(err),
+            stack: err instanceof Error ? err.stack : undefined,
+        });
+        return { ready: false, reason: 'EvaluationError', message: 'Failed to evaluate SearXNG readiness' };
+    }
+}
+/**
+ * Create a SearXNG Deployment resource.
+ *
+ * @example Recommended — mount an existing Secret via `secretKeyRef`
+ * ```typescript
+ * const search = searxng({
+ *   name: 'my-searxng',
+ *   namespace: 'search',
+ *   spec: {
+ *     instanceName: 'My Search',
+ *     search: { formats: ['html', 'json'] },
+ *     server: { limiter: false },
+ *     // Secret is managed externally (Vault, external-secrets operator,
+ *     // or created alongside this factory). The Deployment mounts
+ *     // SEARXNG_SECRET via valueFrom.secretKeyRef — the plaintext
+ *     // never enters the Deployment spec.
+ *     secretKeyRef: { name: 'my-searxng-secret', key: 'secret_key' },
+ *   },
+ * });
+ * ```
+ *
+ * @example Discouraged — plaintext `secret_key` in the config
+ * ```typescript
+ * // Works, but the secret appears in `kubectl get deploy -o yaml` as
+ * // Deployment.spec.template.spec.containers[0].env[].value. Prefer the
+ * // `secretKeyRef` path above or use the `searxngBootstrap` composition
+ * // which auto-creates a K8s Secret and wires it through for you.
+ * const search = searxng({
+ *   name: 'my-searxng',
+ *   spec: {
+ *     server: { secret_key: process.env.SEARXNG_SECRET_KEY!, limiter: false },
+ *   },
+ * });
+ * ```
+ */
+function createSearxngResource(config) {
+    const image = config.spec.image ?? DEFAULT_SEARXNG_IMAGE;
+    const replicas = config.spec.replicas ?? 1;
+    const port = DEFAULT_SEARXNG_PORT;
+    const configMapName = config.spec.configMapName ?? `${config.name}-config`;
+    const env = [];
+    if (config.spec.instanceName) {
+        env.push({ name: 'INSTANCE_NAME', value: config.spec.instanceName });
+    }
+    if (config.spec.baseUrl) {
+        env.push({ name: 'BASE_URL', value: config.spec.baseUrl });
+    }
+    // SEARXNG_SECRET delivery — secret_key is NEVER written into the ConfigMap.
+    //
+    // Precedence:
+    //   1. secretKeyRef — mount an existing K8s Secret via valueFrom.secretKeyRef.
+    //      This is the recommended production path: the secret never appears
+    //      in Deployment spec, pod env dumps, or `kubectl get deploy -o yaml`.
+    //      The bootstrap composition always uses this path.
+    //   2. server.secret_key (plaintext) — fallback for direct-mode callers who
+    //      manage their own secret injection. Insecure: appears in
+    //      Deployment.spec.template.spec.containers[].env[].value. Logged with
+    //      a deprecation warning below; prefer secretKeyRef in new code.
+    if (config.spec.secretKeyRef) {
+        env.push({
+            name: 'SEARXNG_SECRET',
+            valueFrom: {
+                secretKeyRef: {
+                    name: config.spec.secretKeyRef.name,
+                    key: config.spec.secretKeyRef.key,
+                },
+            },
+        });
+    }
+    else if (config.spec.server?.secret_key) {
+        env.push({ name: 'SEARXNG_SECRET', value: config.spec.server.secret_key });
+    }
+    if (config.spec.env) {
+        for (const [key, value] of Object.entries(config.spec.env)) {
+            env.push({ name: key, value });
+        }
+    }
+    return createResource({
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: {
+            name: config.name,
+            ...(config.namespace && { namespace: config.namespace }),
+            labels: {
+                'app.kubernetes.io/name': 'searxng',
+                'app.kubernetes.io/instance': config.name,
+                'app.kubernetes.io/managed-by': 'typekro',
+            },
+        },
+        spec: {
+            replicas,
+            selector: {
+                matchLabels: {
+                    'app.kubernetes.io/name': 'searxng',
+                    'app.kubernetes.io/instance': config.name,
+                },
+            },
+            template: {
+                metadata: {
+                    labels: {
+                        'app.kubernetes.io/name': 'searxng',
+                        'app.kubernetes.io/instance': config.name,
+                    },
+                },
+                spec: {
+                    containers: [
+                        {
+                            name: 'searxng',
+                            image,
+                            ...(config.spec.imagePullPolicy && { imagePullPolicy: config.spec.imagePullPolicy }),
+                            ports: [{ name: 'http', containerPort: port, protocol: 'TCP' }],
+                            ...(env.length > 0 && { env }),
+                            ...(config.spec.resources && { resources: config.spec.resources }),
+                            volumeMounts: [
+                                {
+                                    name: 'searxng-config',
+                                    mountPath: '/etc/searxng/settings.yml',
+                                    subPath: 'settings.yml',
+                                    readOnly: true,
+                                },
+                            ],
+                            // SearXNG takes 10-20s to initialize engines.
+                            // Use startupProbe to avoid premature liveness kills.
+                            startupProbe: {
+                                httpGet: { path: '/healthz', port: 'http' },
+                                initialDelaySeconds: 5,
+                                periodSeconds: 5,
+                                failureThreshold: 6,
+                            },
+                            livenessProbe: {
+                                httpGet: { path: '/healthz', port: 'http' },
+                                periodSeconds: 10,
+                            },
+                            readinessProbe: {
+                                httpGet: { path: '/healthz', port: 'http' },
+                                periodSeconds: 5,
+                            },
+                        },
+                    ],
+                    volumes: [
+                        {
+                            name: 'searxng-config',
+                            configMap: { name: configMapName },
+                        },
+                    ],
+                    ...(config.spec.nodeSelector && { nodeSelector: config.spec.nodeSelector }),
+                    ...(config.spec.tolerations && { tolerations: config.spec.tolerations }),
+                },
+            },
+        },
+        ...(config.id && { id: config.id }),
+    }, { scope: 'namespaced' }).withReadinessEvaluator(searxngReadinessEvaluator);
+}
+export const searxng = createSearxngResource;
+//# sourceMappingURL=searxng.js.map

package/dist/factories/searxng/resources/searxng.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"searxng.js","sourceRoot":"","sources":["../../../../src/factories/searxng/resources/searxng.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,eAAe,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;AAChE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AAoBrB,SAAS,yBAAyB,CAAC,YAAqB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAGhB,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC;QAElD,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,OAAO,iBAAiB,EAAE,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,OAAO,iBAAiB,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,kEAAkE;QAClE,8DAA8D;QAC9D,2DAA2D;QAC3D,eAAe,CAAC,KAAK,CAAC,oCAAoC,EAAE;YAC1D,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACpD,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAS,qBAAqB,CAC5B,MAAwC;IAExC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,qBAAqB,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,oBAAoB,CAAC;IAClC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,GAAG,MAAM,CAAC,IAAI,SAAS,CAAC;IAE3E,MAAM,GAAG,GAAiE,EAAE,CAAC;IAE7E,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,4EAA4E;IAC5E,EAAE;IACF,cAAc;IACd,+EAA+E;IAC/E,yEAAyE;IACzE,2EAA2E;IAC3E,wDAAwD;IACxD,4EAA4E;IAC5E,+DAA+D;IAC/D,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE;gBACT,YAAY,EAAE;oBACZ,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI;oBACnC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG;iBAClC;aACF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CACnB;QACE,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,EAAE;gBACN,wBAAwB,EAAE,SAAS;gBACnC,4BAA4B,EAAE,MAAM,CAAC,IAAI;gBACzC,8BAA8B,EAAE,SAAS;aAC1C;SACF;QACD,IAAI,EAAE;YACJ,QAAQ;YACR,QAAQ,EAAE;gBACR,WAAW,EAAE;oBACX,wBAAwB,EAAE,SAAS;oBACnC,4BAA4B,EAAE,MAAM,CAAC,IAAI;iBAC1C;aACF;YACD,QAAQ,EAAE;gBACR,QAAQ,EAAE;oBACR,MAAM,EAAE;wBACN,wBAAwB,EAAE,SAAS;wBACnC,4BAA4B,EAAE,MAAM,CAAC,IAAI;qBAC1C;iBACF;gBACD,IAAI,EAAE;oBACJ,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,SAAS;4BACf,KAAK;4BACL,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;4BACpF,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;4BAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;4BAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;4BAClE,YAAY,EAAE;gCACZ;oCACE,IAAI,EAAE,gBAAgB;oCACtB,SAAS,EAAE,2BAA2B;oCACtC,OAAO,EAAE,cAAc;oCACvB,QAAQ,EAAE,IAAI;iCACf;6BACF;4BACD,8CAA8C;4BAC9C,sDAAsD;4BACtD,YAAY,EAAE;gCACZ,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gCAC3C,mBAAmB,EAAE,CAAC;gCACtB,aAAa,EAAE,CAAC;gCAChB,gBAAgB,EAAE,CAAC;6BACpB;4BACD,aAAa,EAAE;gCACb,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gCAC3C,aAAa,EAAE,EAAE;6BAClB;4BACD,cAAc,EAAE;gCACd,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gCAC3C,aAAa,EAAE,CAAC;6BACjB;yBACF;qBACF;oBACD,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,gBAAgB;4BACtB,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;yBACnC;qBACF;oBACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;iBACzE;aACF;SACF;QACD,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;KACpC,EACD,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC,sBAAsB,CAAC,yBAAyB,CAGjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAAC"}

package/dist/factories/searxng/types.d.ts

@@ -0,0 +1,127 @@
+/**
+ * SearXNG Types
+ *
+ * Schema-first type definitions for the SearXNG metasearch engine integration.
+ * Config types are inferred from ArkType schemas. Status types are interfaces
+ * representing K8s API responses.
+ *
+ * SearXNG is a privacy-respecting metasearch engine that aggregates results
+ * from multiple search providers. It runs as a single container with a
+ * YAML configuration file.
+ *
+ * @module
+ */
+export declare const SearxngConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    spec: {
+        image?: string;
+        imagePullPolicy?: "Always" | "IfNotPresent" | "Never";
+        replicas?: number;
+        instanceName?: string;
+        baseUrl?: string;
+        configMapName?: string;
+        server?: {
+            secret_key?: string;
+            limiter?: boolean;
+            bind_address?: string;
+            method?: string;
+        };
+        secretKeyRef?: {
+            name: string;
+            key: string;
+        };
+        search?: {
+            formats?: string[];
+            default_lang?: string;
+            autocomplete?: string;
+            safe_search?: 0 | 1 | 2;
+        };
+        redisUrl?: string;
+        env?: Record<string, string>;
+        resources?: {
+            requests?: {
+                cpu?: string;
+                memory?: string;
+            };
+            limits?: {
+                cpu?: string;
+                memory?: string;
+            };
+        };
+        nodeSelector?: Record<string, string>;
+        tolerations?: {
+            key?: string;
+            operator?: "Exists" | "Equal";
+            value?: string;
+            effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute";
+        }[];
+    };
+    namespace?: string;
+    id?: string;
+}, {}>;
+export type SearxngConfig = typeof SearxngConfigSchema.infer;
+export interface SearxngStatus {
+    /** Whether the deployment is ready. */
+    ready?: boolean;
+    /** Number of ready replicas. */
+    readyReplicas?: number;
+    /** Number of desired replicas. */
+    replicas?: number;
+    /** Standard K8s conditions. */
+    conditions?: Array<{
+        type: string;
+        status: string;
+        message?: string;
+    }>;
+}
+export declare const SearxngBootstrapConfigSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    name: string;
+    namespace?: string;
+    enabled?: boolean;
+    image?: string;
+    replicas?: number;
+    instanceName?: string;
+    baseUrl?: string;
+    server?: {
+        secret_key?: string;
+        limiter?: boolean;
+        bind_address?: string;
+        method?: string;
+    };
+    secretKeyRef?: {
+        name: string;
+        key: string;
+    };
+    search?: {
+        formats?: string[];
+        default_lang?: string;
+        autocomplete?: string;
+        safe_search?: 0 | 1 | 2;
+    };
+    redisUrl?: string;
+    settingsYaml?: string;
+    env?: Record<string, string>;
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+}, {}>;
+export type SearxngBootstrapConfig = typeof SearxngBootstrapConfigSchema.infer;
+export declare const SearxngBootstrapStatusSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    ready: boolean;
+    phase: "Ready" | "Installing" | "Disabled";
+    failed: boolean;
+    url: string;
+}, {}>;
+export type SearxngBootstrapStatus = typeof SearxngBootstrapStatusSchema.infer;
+/** Default SearXNG image. Pinned to a specific version to avoid breaking config changes. */
+export declare const DEFAULT_SEARXNG_IMAGE = "searxng/searxng:2026.3.29-7ac4ff39f";
+/** Default SearXNG port. */
+export declare const DEFAULT_SEARXNG_PORT = 8080;
+//# sourceMappingURL=types.d.ts.map

package/dist/factories/searxng/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/factories/searxng/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAiE9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,mBAAmB,CAAC,KAAK,CAAC;AAM7D,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxE;AAMD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAqDvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,KAAK,CAAC;AAE/E,eAAO,MAAM,4BAA4B;;;;;MAMvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,OAAO,4BAA4B,CAAC,KAAK,CAAC;AAE/E,4FAA4F;AAC5F,eAAO,MAAM,qBAAqB,wCAAwC,CAAC;AAE3E,4BAA4B;AAC5B,eAAO,MAAM,oBAAoB,OAAO,CAAC"}

package/dist/factories/searxng/types.js

@@ -0,0 +1,177 @@
+/**
+ * SearXNG Types
+ *
+ * Schema-first type definitions for the SearXNG metasearch engine integration.
+ * Config types are inferred from ArkType schemas. Status types are interfaces
+ * representing K8s API responses.
+ *
+ * SearXNG is a privacy-respecting metasearch engine that aggregates results
+ * from multiple search providers. It runs as a single container with a
+ * YAML configuration file.
+ *
+ * @module
+ */
+import { type } from 'arktype';
+// ============================================================================
+// Shared schema shapes
+// ============================================================================
+/** SearXNG server configuration shape. */
+const serverConfigShape = {
+    /** Secret key for session encryption. */
+    'secret_key?': 'string',
+    /** Enable/disable the built-in rate limiter. */
+    'limiter?': 'boolean',
+    /** Bind address (default: '0.0.0.0:8080'). */
+    'bind_address?': 'string',
+    /** HTTP method (default: 'GET'). */
+    'method?': 'string',
+};
+/** SearXNG search configuration shape. */
+const searchConfigShape = {
+    /** Enabled response formats. */
+    'formats?': 'string[]',
+    /** Default language. */
+    'default_lang?': 'string',
+    /** Autocomplete provider (e.g., 'google', 'duckduckgo', false to disable). */
+    'autocomplete?': 'string',
+    /** Safe search level (0=off, 1=moderate, 2=strict). */
+    'safe_search?': '0 | 1 | 2',
+};
+// ============================================================================
+// SearXNG Deployment Config
+// ============================================================================
+export const SearxngConfigSchema = type({
+    /** Resource name. */
+    name: 'string',
+    /** Target namespace. */
+    'namespace?': 'string',
+    /** Composition resource ID. */
+    'id?': 'string',
+    spec: {
+        /** Container image (default: 'searxng/searxng:2026.3.29-7ac4ff39f'). */
+        'image?': 'string',
+        /** Image pull policy. */
+        'imagePullPolicy?': '"Always" | "Never" | "IfNotPresent"',
+        /** Number of replicas (default: 1). */
+        'replicas?': 'number',
+        /** SearXNG instance name shown in the UI. */
+        'instanceName?': 'string',
+        /** Base URL for the instance (used for redirects/links). */
+        'baseUrl?': 'string',
+        /** ConfigMap name for settings (default: '{name}-config'). */
+        'configMapName?': 'string',
+        /**
+         * Server configuration. `secret_key` is NEVER written into the ConfigMap.
+         * The preferred delivery channel is `secretKeyRef` (below) which mounts
+         * an existing Secret via `valueFrom.secretKeyRef` — that keeps the key
+         * out of Deployment spec and pod descriptions. Passing a plaintext
+         * `secret_key` directly is supported for direct-mode callers who manage
+         * their own secrets, but it results in the value appearing in
+         * `Deployment.spec.template.spec.containers[].env[].value` which is
+         * visible to anyone with `kubectl get deployment -o yaml`. Prefer
+         * `secretKeyRef` in production.
+         */
+        'server?': serverConfigShape,
+        /**
+         * Reference to an existing K8s Secret containing the SearXNG secret key.
+         * When set, the Deployment mounts `SEARXNG_SECRET` via
+         * `valueFrom.secretKeyRef` and any plaintext `server.secret_key` is
+         * ignored. This is the recommended production pattern — pair it with
+         * an external-secrets operator (Vault, AWS SM, etc.) or create the
+         * Secret separately.
+         */
+        'secretKeyRef?': {
+            name: 'string',
+            key: 'string',
+        },
+        /** Search configuration. */
+        'search?': searchConfigShape,
+        /** Redis/Valkey URL for the built-in rate limiter (e.g., 'redis://valkey:6379/0'). */
+        'redisUrl?': 'string',
+        /** Additional environment variables. */
+        'env?': 'Record<string, string>',
+        /** Resource requests and limits. */
+        'resources?': {
+            'requests?': { 'cpu?': 'string', 'memory?': 'string' },
+            'limits?': { 'cpu?': 'string', 'memory?': 'string' },
+        },
+        /** Node selector for scheduling. */
+        'nodeSelector?': 'Record<string, string>',
+        /** Tolerations for scheduling. */
+        'tolerations?': type({
+            'key?': 'string',
+            'operator?': '"Exists" | "Equal"',
+            'value?': 'string',
+            'effect?': '"NoSchedule" | "PreferNoSchedule" | "NoExecute"',
+        }).array(),
+    },
+});
+// ============================================================================
+// Bootstrap Composition Config
+// ============================================================================
+export const SearxngBootstrapConfigSchema = type({
+    /** Instance name. */
+    name: 'string',
+    /** Target namespace (default: 'searxng'). */
+    'namespace?': 'string',
+    /** Whether to create SearXNG resources (default: true). */
+    'enabled?': 'boolean',
+    /** Container image (default: 'searxng/searxng:2026.3.29-7ac4ff39f'). */
+    'image?': 'string',
+    /** Number of replicas (default: 1). */
+    'replicas?': 'number',
+    /** SearXNG instance name shown in the UI. */
+    'instanceName?': 'string',
+    /** Base URL for the instance. */
+    'baseUrl?': 'string',
+    /**
+     * Server configuration. When `secretKeyRef` is NOT provided, the bootstrap
+     * composition requires `server.secret_key`, creates a dedicated K8s Secret
+     * (`{name}-secret`), and mounts it via `valueFrom.secretKeyRef` on the
+     * Deployment.
+     */
+    'server?': serverConfigShape,
+    /**
+     * Reference to a pre-existing K8s Secret containing the SearXNG secret
+     * key. Use this with external-secrets-operator, Vault, or any workflow
+     * where the Secret's lifecycle is managed outside TypeKro. When set,
+     * the bootstrap SKIPS creating its own Secret and wires the existing
+     * one through to the Deployment via `valueFrom.secretKeyRef`. In KRO
+     * mode this is resolved via `has(schema.spec.secretKeyRef)` so the
+     * user can decide per-instance whether to provide an external ref or
+     * fall back to the auto-created Secret.
+     */
+    'secretKeyRef?': {
+        name: 'string',
+        key: 'string',
+    },
+    /** Search configuration. */
+    'search?': searchConfigShape,
+    /** Redis/Valkey URL for the built-in rate limiter (e.g., 'redis://valkey:6379/0'). */
+    'redisUrl?': 'string',
+    /**
+     * Complete settings.yml content as a string. When provided in direct mode,
+     * this overrides the auto-generated settings. Use buildSearxngSettings()
+     * or read from a file.
+     */
+    'settingsYaml?': 'string',
+    /** Additional environment variables. */
+    'env?': 'Record<string, string>',
+    /** Resource requests and limits. */
+    'resources?': {
+        'requests?': { 'cpu?': 'string', 'memory?': 'string' },
+        'limits?': { 'cpu?': 'string', 'memory?': 'string' },
+    },
+});
+export const SearxngBootstrapStatusSchema = type({
+    ready: 'boolean',
+    phase: '"Ready" | "Installing" | "Disabled"',
+    failed: 'boolean',
+    /** The internal service URL. */
+    url: 'string',
+});
+/** Default SearXNG image. Pinned to a specific version to avoid breaking config changes. */
+export const DEFAULT_SEARXNG_IMAGE = 'searxng/searxng:2026.3.29-7ac4ff39f';
+/** Default SearXNG port. */
+export const DEFAULT_SEARXNG_PORT = 8080;
+//# sourceMappingURL=types.js.map

package/dist/factories/searxng/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/factories/searxng/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E,0CAA0C;AAC1C,MAAM,iBAAiB,GAAG;IACxB,yCAAyC;IACzC,aAAa,EAAE,QAAQ;IACvB,gDAAgD;IAChD,UAAU,EAAE,SAAS;IACrB,8CAA8C;IAC9C,eAAe,EAAE,QAAQ;IACzB,oCAAoC;IACpC,SAAS,EAAE,QAAQ;CACX,CAAC;AAEX,0CAA0C;AAC1C,MAAM,iBAAiB,GAAG;IACxB,gCAAgC;IAChC,UAAU,EAAE,UAAU;IACtB,wBAAwB;IACxB,eAAe,EAAE,QAAQ;IACzB,8EAA8E;IAC9E,eAAe,EAAE,QAAQ;IACzB,uDAAuD;IACvD,cAAc,EAAE,WAAW;CACnB,CAAC;AAEX,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACtC,qBAAqB;IACrB,IAAI,EAAE,QAAQ;IACd,wBAAwB;IACxB,YAAY,EAAE,QAAQ;IACtB,+BAA+B;IAC/B,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE;QACJ,wEAAwE;QACxE,QAAQ,EAAE,QAAQ;QAClB,yBAAyB;QACzB,kBAAkB,EAAE,qCAAqC;QACzD,uCAAuC;QACvC,WAAW,EAAE,QAAQ;QACrB,6CAA6C;QAC7C,eAAe,EAAE,QAAQ;QACzB,4DAA4D;QAC5D,UAAU,EAAE,QAAQ;QACpB,8DAA8D;QAC9D,gBAAgB,EAAE,QAAQ;QAC1B;;;;;;;;;;WAUG;QACH,SAAS,EAAE,iBAAiB;QAC5B;;;;;;;WAOG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,QAAQ;SACd;QACD,4BAA4B;QAC5B,SAAS,EAAE,iBAAiB;QAC5B,sFAAsF;QACtF,WAAW,EAAE,QAAQ;QACrB,wCAAwC;QACxC,MAAM,EAAE,wBAAwB;QAChC,oCAAoC;QACpC,YAAY,EAAE;YACZ,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtD,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;SACrD;QACD,oCAAoC;QACpC,eAAe,EAAE,wBAAwB;QACzC,kCAAkC;QAClC,cAAc,EAAE,IAAI,CAAC;YACnB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,oBAAoB;YACjC,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,iDAAiD;SAC7D,CAAC,CAAC,KAAK,EAAE;KACX;CACF,CAAC,CAAC;AAmBH,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,qBAAqB;IACrB,IAAI,EAAE,QAAQ;IACd,6CAA6C;IAC7C,YAAY,EAAE,QAAQ;IACtB,2DAA2D;IAC3D,UAAU,EAAE,SAAS;IACrB,wEAAwE;IACxE,QAAQ,EAAE,QAAQ;IAClB,uCAAuC;IACvC,WAAW,EAAE,QAAQ;IACrB,6CAA6C;IAC7C,eAAe,EAAE,QAAQ;IACzB,iCAAiC;IACjC,UAAU,EAAE,QAAQ;IACpB;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB;IAC5B;;;;;;;;;OASG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,QAAQ;KACd;IACD,4BAA4B;IAC5B,SAAS,EAAE,iBAAiB;IAC5B,sFAAsF;IACtF,WAAW,EAAE,QAAQ;IACrB;;;;OAIG;IACH,eAAe,EAAE,QAAQ;IACzB,wCAAwC;IACxC,MAAM,EAAE,wBAAwB;IAChC,oCAAoC;IACpC,YAAY,EAAE;QACZ,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;QACtD,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;KACrD;CACF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC/C,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,qCAAqC;IAC5C,MAAM,EAAE,SAAS;IACjB,gCAAgC;IAChC,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAIH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,qBAAqB,GAAG,qCAAqC,CAAC;AAE3E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC"}

package/dist/factories/searxng/utils/settings-builder.d.ts

@@ -0,0 +1,47 @@
+/**
+ * SearXNG Settings Builder
+ *
+ * Constructs a settings.yml string from typed configuration fields.
+ * Pass the result as `settingsYaml` to the bootstrap composition in direct
+ * mode when you need full control over the generated ConfigMap. KRO mode
+ * ignores `settingsYaml` from the schema because it is a proxy reference, not
+ * a concrete string available at RGD generation time.
+ *
+ * @example
+ * ```typescript
+ * import { buildSearxngSettings } from 'typekro/searxng';
+ *
+ * const settings = buildSearxngSettings({
+ *   server: { limiter: false },
+ *   search: { formats: ['html', 'json'] },
+ *   redisUrl: 'redis://valkey:6379/0',
+ * });
+ * // Returns a valid settings.yml string
+ * ```
+ */
+export interface SearxngSettingsInput {
+    /** Server configuration. secret_key is stripped (use SEARXNG_SECRET env var). */
+    server?: {
+        secret_key?: string;
+        limiter?: boolean;
+        bind_address?: string;
+        method?: string;
+    };
+    /** Search configuration. */
+    search?: {
+        formats?: string[];
+        default_lang?: string;
+        autocomplete?: string;
+        safe_search?: 0 | 1 | 2;
+    };
+    /** Redis/Valkey URL for the built-in rate limiter. */
+    redisUrl?: string;
+}
+/**
+ * Build a SearXNG settings.yml string from typed configuration.
+ *
+ * The secret_key is automatically stripped — it should be injected
+ * via the SEARXNG_SECRET environment variable, not stored in the ConfigMap.
+ */
+export declare function buildSearxngSettings(input: SearxngSettingsInput): string;
+//# sourceMappingURL=settings-builder.d.ts.map

package/dist/factories/searxng/utils/settings-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-builder.d.ts","sourceRoot":"","sources":["../../../../src/factories/searxng/utils/settings-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,4BAA4B;IAC5B,MAAM,CAAC,EAAE;QACP,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACzB,CAAC;IACF,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA0BxE"}