fix(docker): prevent SearXNG fatal exit on ultrasecretkey sentinel

The pinned SearXNG (2026.6.8) treats the "ultrasecretkey" secret_key as
fatal in production mode (sys.exit(1)), not a warning. When .env omits
SEARXNG_SECRET, the compose `:-ultrasecretkey` fallback crashed the
sidecar on startup. Switch the fallback and settings.yml default to a
non-sentinel internal default (instance is internal-only, single trusted
consumer) so it boots reliably; users still override for exposed setups.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jkyberneees

docker/.env.example

@@ -79,6 +79,8 @@ GIT_COMMITTER_EMAIL=you@example.com
 # The compose file runs a private SearXNG instance backing the `web_search`
 # tool. SearXNG reads this as server.secret_key at app load and it overrides
 # settings.yml. Set a strong random secret (e.g. `openssl rand -hex 32`). The
-# instance is internal-only (no host port) but set it anyway — left unset,
-# SearXNG runs with the "ultrasecretkey" sentinel and logs a warning.
+# instance is internal-only (no host port); if you leave SEARXNG_SECRET unset,
+# compose falls back to a static internal default so the sidecar still boots.
+# Do NOT set it to the literal "ultrasecretkey" — in production mode SearXNG
+# treats that sentinel as fatal and the worker exits on startup.
 SEARXNG_SECRET=change-me-run-openssl-rand-hex-32

docker/docker-compose.yml

@@ -137,10 +137,13 @@ services:
     environment:
       - SEARXNG_BASE_URL=http://searxng:8080/
       # SearXNG reads server.secret_key from this env var at app load, overriding
-      # settings.yml. Set SEARXNG_SECRET in .env. The fallback is the canonical
-      # "ultrasecretkey" sentinel so an unset secret triggers SearXNG's own
-      # "secret_key is not changed" warning rather than a silent weak literal.
-      - SEARXNG_SECRET=${SEARXNG_SECRET:-ultrasecretkey}
+      # settings.yml. Set SEARXNG_SECRET in .env. The fallback must NOT be the
+      # "ultrasecretkey" sentinel: in production (non-debug) mode SearXNG treats
+      # that literal as FATAL — it logs "secret_key is not changed" and calls
+      # sys.exit(1), so the worker dies and the container never serves. This
+      # internal-only instance (no host port, single trusted consumer) is fine
+      # with a static default; override it in .env for any exposed deployment.
+      - SEARXNG_SECRET=${SEARXNG_SECRET:-odek-searxng-internal-default-override-in-env}
     volumes:
       - ./searxng/settings.yml:/etc/searxng/settings.yml:ro
     # SearXNG needs outbound internet to query upstream engines (Google, Bing,

docker/searxng/settings.yml

@@ -21,11 +21,12 @@ general:
 server:
   # SearXNG reads server.secret_key from the SEARXNG_SECRET env var at app load
   # (searx/settings_defaults.py: environ_name='SEARXNG_SECRET'), which overrides
-  # this value — set SEARXNG_SECRET in .env. Keep this as the canonical
-  # "ultrasecretkey" placeholder so that, if SEARXNG_SECRET is ever left unset,
-  # SearXNG logs its built-in "secret_key is not changed" warning instead of
-  # silently running with a custom-but-weak literal.
-  secret_key: "ultrasecretkey"
+  # this value — set SEARXNG_SECRET in .env. This must NOT be the literal
+  # "ultrasecretkey": in production (non-debug) mode SearXNG treats that sentinel
+  # as fatal (logs "secret_key is not changed" and exits the worker), so a
+  # missing env override would crash startup. This is a private, internal-only
+  # instance (single trusted consumer), so a static default is acceptable.
+  secret_key: "odek-searxng-internal-default-override-in-env"
   bind_address: "0.0.0.0"
   port: 8080
   # Single trusted consumer on a private network — disable the bot limiter