[SearXNG] Update and fix config

system/hosts/mcp/containers/searxng.nix

@@ -1,10 +1,24 @@
-
 { config, ... }:
-let inherit (import ./lib.nix config) havenisms mkContainer; in
+let
+  inherit (import ./lib.nix config) havenisms mkContainer;
+in
 {
+  sops = {
+    secrets = {
+      "searxng/secret" = { };
+    };
+    templates."searxng.env" = {
+      mode = "0400";
+      content = ''
+        SEARXNG_BASE_URL=https://search.${havenisms}
+        SEARXNG_VALKEY_URL=valkey://valkey:6379/0
+        SEARXNG_SECRET=${config.sops.placeholder."searxng/secret"}
+      '';
+    };
+  };
   virtualisation.oci-containers.containers.searxng = mkContainer {
     hostName = "search";
-    image = "docker.io/searxng/searxng:latest";
+    image = "searxng/searxng:latest";
     port = 8080;
     public = true;
     dependsOn = [
@@ -19,9 +33,9 @@ let inherit (import ./lib.nix config) havenisms mkContainer; in
     volumes = [
       "/tank/config/searxng:/etc/searxng"
     ];
-    environment = {
-      SEARXNG_BASE_URL = "https://search.${havenisms}";
-      SEARXNG_REDIS_URL = "redis://valkey:6379/0";
-    };
+    environmentFiles = [
+      config.sops.templates."searxng.env".path
+    ];
+    extraOptions = [ "--pull=always" ];
   };
 }