chaotic-backend (aerialis)

This container provides backend services for Chaotic-AUR, including API endpoints and job processing for the repository.

Nix expression

{
  config,
  garuda-lib,
  sources,
  ...
}:
{
  imports = sources.defaultModules ++ [
    ../../modules
    ../../modules/special/ssh-allow-chaotic.nix
  ];

  garuda =
    garuda-lib.mkMonitoring {
      host = "aerialis";
      units = [
        "compose-runner-chaotic-backend.service"
        "docker.service"
        "redis-chaotic.service"
      ];
      exporters = [ "redisExporter" ];
      extraPrometheus.redisExporter.passwordFile = config.sops.secrets."redis/exporter".path;
    }
    // {
      services.compose-runner.chaotic-backend = {
        envfile = config.sops.secrets."compose/chaotic-backend".path;
        source = ../../../compose/chaotic-backend;
        extraEnv = {
          "SSH_KEY" = config.sops.secrets."keypairs/chaotic/private".path;
        };
      };
    };

  services.redis = {
    servers."chaotic" = {
      enable = true;
      port = 6379;
      requirePassFile = config.sops.secrets."redis/chaotic".path;
      save = [
        [
          20
          1
        ]
      ];
    };
  };

  sops.secrets =
    garuda-lib.mkSecrets [
      "compose/chaotic-backend"
      "keypairs/chaotic/private"
      "redis/chaotic"
    ]
    // {
      "redis/exporter" = {
        owner = "redis-exporter";
        group = "redis-exporter";
        mode = "0400";
      };
    };

  system.stateVersion = "25.05";
}

Docker containers

services:
  chaotic-backend:
    image: ghcr.io/chaotic-cx/chaotic-next:2.9.0-pre
    container_name: chaotic-backend
    deploy:
      restart_policy:
        condition: always
        delay: 30s
    environment:
      AUR_USERNAME: ${AUR_USERNAME:-?err}
      AUR_PASSWORD: ${AUR_PASSWORD:-?err}
      AUTH_COOKIE_DOMAIN: .chaotic.cx
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-?err}
      BETTER_AUTH_TRUSTED_ORIGINS: https://aur.chaotic.cx
      BETTER_AUTH_URL: https://backend.chaotic.cx
      CAUR_BUILDER_CLAMAV_IMAGE: 'clamav/clamav:latest'
      CAUR_BUILDER_CPU_LIMIT: 8
      CAUR_BUILDER_DOCKER_SOCKET: /var/run/docker.sock
      CAUR_BUILDER_EXTRA_PACMAN_KEYRINGS: https://secret-mirror.chaotic.cx/chaotic-aur/chaotic-keyring.pkg.tar.zst
      CAUR_BUILDER_EXTRA_PACMAN_REPOS: |
        [chaotic-aur]
        Server = https://secret-mirror.chaotic.cx/chaotic-aur/x86_64
      CAUR_BUILDER_IDLE_TIMEOUT: 600
      CAUR_BUILDER_IMAGE: registry.gitlab.com/garuda-linux/tools/chaotic-manager/builder:latest
      CAUR_BUILDER_PIDS_LIMIT: 1024
      CAUR_BUILDER_POLL_INTERVAL: 15000
      CAUR_BUILDER_PUBLIC_URL: https://backend.chaotic.cx
      CAUR_BUILDER_RAM_LIMIT: 8192
      CAUR_BUILDER_TIMEOUT: 3600
      CAUR_BUILDER_WORKDIR: /var/garuda/compose-runner/chaotic-backend/portable-builder
      CAUR_DB_KEY: ${CAUR_DB_KEY:-?err}
      CAUR_GITLAB_TOKEN: ${TEMERAIRE_BOT_TOKEN:-?err}
      CAUR_GITLAB_WEBHOOK_TOKEN: ${CAUR_GITLAB_WEBHOOK_TOKEN:-?err}
      CAUR_MANAGER_API_TOKEN: ${CAUR_MANAGER_API_TOKEN:-?err}
      CAUR_TRUST_PROXY: true
      CAUR_VAPID_PRIVATE: ${CAUR_VAPID_PRIVATE:-?err}
      CAUR_VAPID_PUBLIC: BFMijCyTcLZu3HRJyMfoB4vtnDcgl7E2SVZgd4uWB3XjO2VvRh_LjYHcY_oJLvMIhdp5Yvuz0gudRpY-PFI9iWA
      GITHUB_ISSUES_REPO_NAME: packages
      GITHUB_ISSUES_REPO_OWNER: chaotic-aur
      GITHUB_TOKEN: ${GITHUB_TOKEN:-?err}
      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET:-?err}
      GITLAB_CLIENT_ID: ${GITLAB_CLIENT_ID:-?err}
      GITLAB_CLIENT_SECRET: ${GITLAB_CLIENT_SECRET:-?err}
      GITLAB_REDIRECT_URI: https://backend.chaotic.cx/api/auth/callback/gitlab
      LOG_LEVEL: debug
      NODE_ENV: production
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-?err}
      PG_DATABASE: chaotic-aur
      PG_HOST: 10.0.5.20
      PG_PASSWORD: ${PG_PASSWORD:-?err}
      PG_USER: chaotic-aur
      REDIS_PASSWORD: ${REDIS_PASSWORD:-?err}
      REDIS_SSH_HOST: host.docker.internal
      REDIS_SSH_USER: package-deployer
      REPOMANAGER_ABI_DRY_RUN: false
      REPOMANAGER_MIRROR_URL: https://builds.garudalinux.org/arch-mirror
      REPOMANAGER_SIGNAL_SCAN_ENABLED: true
      VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-?err}
    ports: ["3000:3000"]
    volumes:
      - "${SSH_KEY:-?err}:/app/sshkey"
      - "./backend-config:/app/config"
      - "/var/garuda/compose-runner/chaotic-backend/portable-builder:/var/garuda/compose-runner/chaotic-backend/portable-builder"
      - "/var/run/docker.sock:/var/run/docker.sock"
    extra_hosts: ["host.docker.internal:host-gateway"]