feat: add self-hosted SearXNG research mode

apps/api/app/config.py

@@ -2,6 +2,7 @@
 from dataclasses import dataclass
 import os
 from pathlib import Path
+from urllib.parse import urlparse
 
 
 class ConfigError(ValueError):
@@ -17,6 +18,8 @@ class Config:
     log_level: str
     ai_research_provider: str
     ai_research_model: str
+    nous_base_url: str = ""
+    searxng_base_url: str = ""
 
 
 def _env(values, key, default=""):
@@ -42,6 +45,15 @@ def load_config(values=None):
     log_level = _env(values, "LOG_LEVEL", "INFO").upper()
     if log_level not in {"QUIET", "ERROR", "WARNING", "INFO", "DEBUG"}:
         raise ConfigError("LOG_LEVEL is invalid")
-    return Config(app_env, data_dir, secret, False, log_level,
-                  _env(values, "AI_RESEARCH_PROVIDER").lower(),
-                  _env(values, "AI_RESEARCH_PROVIDER_MODEL"))
+    provider = _env(values, "AI_RESEARCH_PROVIDER").lower()
+    nous_url = _env(values, "NOUS_BASE_URL", "https://inference-api.nousresearch.com/v1")
+    searx_url = _env(values, "SEARXNG_BASE_URL", "http://searxng:8080")
+    if provider in {"nous_portal", "nous_portal_web_research"}:
+        parsed = urlparse(nous_url); allowed = {x.strip().lower() for x in _env(values, "NOUS_ALLOWED_HOSTS", "inference-api.nousresearch.com").split(",") if x.strip()}
+        if parsed.scheme != "https" or parsed.hostname not in allowed or parsed.username or parsed.password or parsed.query or parsed.fragment:
+            raise ConfigError("NOUS_BASE_URL is unsafe")
+        parsed = urlparse(searx_url); allowed = {x.strip().lower() for x in _env(values, "SEARXNG_ALLOWED_HOSTS", "searxng").split(",") if x.strip()}
+        if parsed.scheme != "http" or parsed.hostname not in allowed or parsed.username or parsed.password or parsed.query or parsed.fragment:
+            raise ConfigError("SEARXNG_BASE_URL is unsafe")
+    return Config(app_env, data_dir, secret, False, log_level, provider,
+                  _env(values, "AI_RESEARCH_PROVIDER_MODEL") or _env(values, "NOUS_MODEL", "Hermes-4-405B"), nous_url, searx_url)