What causes "invalid SearXNG base_url scheme: %s" in Tencent/WeKnora?

Change the scheme to https (preferred) or http

invalid SearXNG base_url scheme: %s

Error message

invalid SearXNG base_url scheme: %s

What it means

The SearXNG base_url is absolute but its scheme is neither http nor https (e.g. ftp://, file://, socks5://). ValidateSearxngBaseURL restricts schemes to the two web schemes since the provider issues HTTP requests to the instance.

Source

Thrown at internal/infrastructure/web_search/searxng.go:50

	baseURL          string
	lastUnresponsive [][]string
}

// ValidateSearxngBaseURL validates a SearXNG instance URL: must be a non-empty,
// absolute http(s) URL, and must pass the SSRF whitelist check. Shared between
// the service-layer parameter validation and the provider constructor so that
// "save" and "use" never disagree.
func ValidateSearxngBaseURL(rawURL string) error {
	base := strings.TrimSpace(rawURL)
	if base == "" {
		return fmt.Errorf("base_url is required for SearXNG provider")
	}
	parsed, err := url.Parse(base)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
		return fmt.Errorf("invalid SearXNG base_url: must be an absolute http(s) URL")
	}
	if parsed.Scheme != "http" && parsed.Scheme != "https" {
		return fmt.Errorf("invalid SearXNG base_url scheme: %s", parsed.Scheme)
	}
	if parsed.RawQuery != "" || parsed.Fragment != "" {
		return fmt.Errorf("invalid SearXNG base_url: must not contain query or fragment")
	}
	if err := utils.ValidateURLForSSRF(base); err != nil {
		return fmt.Errorf("invalid SearXNG base_url: %w", err)
	}
	return nil
}

// NewSearxngProvider builds a SearXNG provider from tenant parameters.
func NewSearxngProvider(params types.WebSearchProviderParameters) (interfaces.WebSearchProvider, error) {
	base := strings.TrimSpace(params.BaseURL)
	if err := ValidateSearxngBaseURL(base); err != nil {
		return nil, err
	}

	client, err := NewSearchHTTPClient(defaultSearxngTimeout, params.ProxyURL)

View on GitHub (pinned to 988cbb0330)

Solutions

Change the scheme to https (preferred) or http
Verify the instance actually serves plain HTTP(S)
Do not put proxy schemes here; configure proxies via proxy_url instead
Re-check for typos like "htps://" or "https//" (missing colon)

Example fix

// before
baseURL := "socks5://searx.example.com"
// after
baseURL := "https://searx.example.com"

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(baseURL)
if err == nil && u.Scheme != "http" && u.Scheme != "https" {
    return fmt.Errorf("base_url scheme must be http or https, got %q", u.Scheme)
}

Try / catch

if err := web_search.ValidateSearxngBaseURL(cfg.BaseURL); err != nil {
    if strings.Contains(err.Error(), "scheme") {
        return fmt.Errorf("base_url must start with http:// or https://")
    }
    return err
}

Prevention

Restrict scheme choices to http/https in any config UI dropdown
Keep proxy settings (socks5 etc.) in proxy_url, not base_url
Check for scheme typos before saving (htps://, https//)
Validate at config load with the same rules the provider uses

When it happens

Trigger: NewSearxngProvider or save validation with base_url such as "ftp://searx.example.com" or "file:///srv/searxng".

Common situations: Users pasting a SOCKS proxy value into base_url by mistake, config generators emitting unix/https typos like "httpss://", accidental scheme corruption.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/be3a6c010692b2b3. Report an issue: GitHub.