@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   lib,
   ...
@@ -21,6 +22,7 @@ ../roles/exit-node.nix
     ../roles/syncthing.nix
     ../roles/home-automation.nix
     ../roles/tailscale-subnet-router.nix
+    ../settings/services/searchix.nix
     ../settings/hardware/usb-serial-tty.nix
   ];
   age.secrets = {
@@ -40,6 +42,33 @@ # see ../roles/router.nix for remaining settings
     nat = {
       externalInterface = wan;
       internalInterfaces = [ bridge ];
+    };
+  };
+
+  services.dnsmasq.settings.cname = [
+    "searchix.${domain},${hostName}.${domain}"
+  ];
+  services.searchix.settings.web = {
+    listenAddress = "::";
+    baseURL = "https://searchix.${domain}/";
+  };
+  services.caddy.virtualHosts = {
+    "searchix.${domain}" = {
+      extraConfig = ''
+        tls {
+          issuer internal {
+            ca home
+          }
+        }
+        encode
+        reverse_proxy localhost:${toString config.services.searchix.settings.web.port} {
+          health_uri /health
+          health_status 2xx
+          health_interval 10s
+          health_timeout 1s
+          health_fails 2
+        }
+      '';
     };
   };