SearXNG gives you a search front end hosted on a server you control. This guide deploys the current official container stack, places it behind HTTPS, and explains the privacy boundary between your browser, your instance, and the upstream engines.

What Exactly Is SearXNG?

SearXNG is a fork of the original SearX project, designed to be a self-hosted metasearch engine. Instead of building its own index, it sends queries to configured upstream engines and aggregates their results. Those engines normally see the SearXNG server’s network address rather than the browser client’s address, and they do not receive the browser’s cookies for their sites. They still receive the query text and can observe the server, so a uniquely identifying query can still identify its subject. If you share an instance, its operator can also see traffic unless logging and access controls are configured responsibly.

Because it’s open source and runs on your own hardware, you control everything: which engines to use, the UI, rate limits, and custom search plugins. It’s a Swiss Army knife for search that lives entirely in your homelab.

Why Self-Host a Search Engine?

Public SearXNG instances exist, but running your own gives you three big wins:

  • Control of the instance: You choose the software, enabled engines, logging policy, and access controls. Upstream search engines still receive queries from the SearXNG server, and software or host compromise remains possible.
  • Control of the client hop: A local instance removes the internet hop between your browser and SearXNG, but SearXNG must still contact upstream engines, so total search latency remains internet-dependent.
  • Customization: Build profiles that search only academic papers, skip commercial sites, or use only privacy-respecting engines.

The trade-offs are real: you need an always-on machine, you become responsible for access control and updates, and upstream engines can throttle or block the server’s shared address.

What You’ll Need Before Starting

  • Hardware: An always-on x86-64 or ARM64 host. Resource use depends heavily on enabled engines, traffic, bot protection, and image proxying; monitor the container rather than relying on a universal minimum.
  • Operating System: Debian or Ubuntu Server (I’m using Ubuntu 22.04 LTS). Any Linux distro with Docker support will do.
  • Docker and Docker Compose: The easiest deployment method. Install via your package manager or the official convenience script.
  • A domain name (optional but recommended): You can use an IP address, but a domain with HTTPS is cleaner. A free DuckDNS subdomain or a paid domain both work.
  • Basic terminal comfort: You’ll SSH in and edit a few text files. I’ll walk through every command.

Step-by-Step Installation with Docker

Use the Compose template maintained by SearXNG rather than writing a stack from an old blog post. The current official container guide creates a core service plus Valkey:

mkdir -p searxng/core-config
cd searxng
curl -fsSL \
  -O https://raw.githubusercontent.com/searxng/searxng/master/container/docker-compose.yml \
  -O https://raw.githubusercontent.com/searxng/searxng/master/container/.env.example
cp -i .env.example .env
docker compose up -d

The service listens on port 8080 by default. Before exposing it, set SEARXNG_HOST=127.0.0.1 in .env for a same-host reverse proxy, or bind it to a deliberately chosen trusted address. Check it locally, then edit core-config/settings.yml. Generate a unique secret with openssl rand -hex 32 and set the public URL only when you know the final proxy hostname:

server:
  secret_key: "replace-with-a-random-secret"
  base_url: https://search.example.com/
  limiter: true

valkey:
  url: valkey://valkey:6379/0

Restart after configuration changes:

docker compose restart core
docker compose logs -f core

The shipped settings already contain the supported engine definitions. Enable or disable engines by overriding those existing definitions in core-config/settings.yml, using the documentation for the same version as the image you run. Pin SEARXNG_VERSION in .env if you need reproducible upgrades rather than tracking latest.

Putting It Behind a Reverse Proxy with HTTPS

Keep port 8080 bound to localhost or a trusted internal interface and put a maintained reverse proxy in front of it. Configure the proxy to pass the original client address correctly; the limiter depends on trustworthy X-Forwarded-For and X-Real-IP values. Set server.base_url to the final HTTPS URL and use a valid certificate.

If the service is only for your household, a VPN or tailnet is the smaller attack surface. Public exposure means you must maintain the proxy, SearXNG, Valkey, TLS, rate limiting, and access policy. Consult the SearXNG container guide and limiter documentation whenever you update the image because the official templates and settings can change.

Using Your New Private Search Engine

Navigate to https://search.yourdomain.com. The interface is clean and minimal. Type a query and hit enter. SearXNG queries the enabled engines and blends their results. Its own interface does not inject a commercial ad unit by default, although the upstream engines still determine what results they return.

Power-user features worth knowing:

  • Shortcuts: Type !g linux kernel to search only Google, !wp containers for Wikipedia, or !ddg privacy for DuckDuckGo. You can define custom shortcuts in settings.yml.
  • Preferences: Click the gear icon. Set default language, enable safe search, choose engines per category (general, images, videos, etc.), and change the theme. The “simple” theme is lightweight and fast.
  • Search categories: Tabs across the top (Files, Images, IT, Maps, Music, News, Science, Social Media, Videos) narrow results using subsets of engines. Configure these in settings.yml by assigning categories: to each engine.
  • Browser integration: To make SearXNG your default search engine, add a custom search engine with the URL https://search.yourdomain.com/search?q=%s. In Firefox, you can also click the three dots in the SearXNG search bar and select “Add as search engine”.

Customizing SearXNG to Fit Your Needs

Tailoring the engine to your workflow is where the real fun begins.

Tweaking the UI

switch testing themes in settings.yml:

ui:
  default_theme: simple

For deeper visual changes, follow the theme/customization instructions for your installed version. An arbitrary host user.css file does nothing unless the container and selected theme are configured to serve it.

Engine Finetuning

Google often returns the best results but may require occasional CAPTCHA solving (SearXNG has experimental support, but it’s not perfect). If you want to avoid that, disable Google and rely on DuckDuckGo, Startpage, and Bing. Choose engines according to the data you are willing to send upstream. Switching providers changes who receives the server-side request; it does not make the query inherently anonymous.

Engine names and options change over time. Start from the engine definitions shipped with your installed SearXNG version and override only the fields you need; do not paste an old engine stanza that may no longer exist.

Limiting Abuse

If you expose your instance to the internet, enable SearXNG’s limiter and make sure the proxy passes trustworthy client-address headers. The official limiter documentation requires Valkey and supports this local override:

[botdetection.ip_limit]
link_token = true

There is no supported day = 300 option in this table. The built-in limiter uses several sliding windows; do not invent a per-day key. For a small private instance, authentication or tailnet-only access is often simpler than exposing an unauthenticated public endpoint.

Maintenance and Keeping Things Healthy

SearXNG is low-maintenance, but a few regular tasks keep it smooth.

  • Updates: Pull the latest image monthly: sudo docker compose pull && sudo docker compose up -d.
  • Monitoring: Watch logs with docker compose logs -f core. If an engine consistently fails, disable it. Upstream engines change interfaces and defenses, so review errors before assuming the local container is broken.
  • Backups: Back up core-config, your .env, and any deployment-specific reverse-proxy configuration. The official Compose stack also has persistent Valkey and cache volumes; decide whether their transient state matters to your recovery plan.
  • Performance: Measure your instance with its actual engine set and traffic. If searches are slow or unreliable, inspect per-engine errors and timeouts before raising the global request timeout; a failing engine can be disabled without slowing every query.

Honest Trade-Offs

SearXNG has a few rough edges. You’re at the mercy of upstream search engines—if Google changes its result parsing or throws a CAPTCHA, that engine might temporarily break. Updates often repair upstream breakage, but there is no guaranteed recovery time, so it is not a set-it-and-forget-it service. Image and video search can be less consistent because it depends on several upstream engines; enabling SearXNG’s optional image proxy also adds work to your instance. And if you’re used to personalized results (like Google’s location-aware restaurant searches), you’ll miss that—though you can set a default location in preferences.

Whether the control outweighs the quirks is your call. The SearXNG software gives you control over local logging and configured engines, but upstream providers still receive queries from the server. You can adjust engines and result-processing plugins to fit your needs. It’s a constant reminder that the internet still belongs to us.

Wrapping Up

Running your own private search engine sounds massive, but with SearXNG and Docker it’s a weekend project that pays off every day. You get an ad-free interface you control and can reduce how much client metadata reaches upstream engines, while still accepting the privacy limits of a metasearch proxy. Start with a basic setup on a spare machine, then tweak the engines, theme, and access controls until it feels like home. Once you have reduced the metadata exposed on the browser-to-instance hop and chosen the upstream engines deliberately, it is hard to go back. Grab that old Pi, fire up Docker, and give yourself the search engine you deserve.