chaotic-backend (aerialis)

This container provides backend services for Chaotic-AUR, including API endpoints and job processing for the repository.

Nix expression

{
  config,
  sources,
  ...
}:
{
  imports = sources.defaultModules ++ [
    ../../modules
    ../../modules/special/ssh-allow-chaotic.nix
  ];

  garuda.services.compose-runner.chaotic-backend = {
    envfile = config.sops.secrets."compose/chaotic-backend".path;
    source = ../../../compose/chaotic-backend;
    extraEnv = {
      "SSH_KEY" = config.sops.secrets."keypairs/chaotic/private".path;
    };
  };

  sops.secrets = {
    "compose/chaotic-backend" = { };
    "keypairs/chaotic/private" = { };
    "redis/chaotic" = { };
  };

  system.stateVersion = "25.05";
}

Docker containers

services:
  chaotic-backend:
    image: ghcr.io/chaotic-cx/chaotic-next:main
    container_name: chaotic-backend
    deploy:
      restart_policy:
        condition: always
        delay: 30s
    environment:
      AUTH0_AUDIENCE: http://localhost:3000/auth/auth0
      AUTH0_CLIENT_ID: ${AUTH0_CLIENT_ID:-?err}
      AUTH0_CLIENT_SECRET: ${AUTH0_CLIENT_SECRET:-?err}
      AUTH0_DOMAIN: ${AUTH0_DOMAIN:-?err}
      CAUR_DB_KEY: ${CAUR_DB_KEY:-?err}
      CAUR_GITLAB_ID_CAUR: 54867625
      CAUR_GITLAB_ID_GARUDA: 48461689
      CAUR_GITLAB_TOKEN: ${GITLAB_TOKEN_CX:-?err}
      CAUR_GITLAB_WEBHOOK_TOKEN: ${CAUR_GITLAB_WEBHOOK_TOKEN:-?err}
      CAUR_JWT_SECRET: ${CAUR_JWT_SECRET:-?err}
      CAUR_TRUST_PROXY: 172.18.0.1
      CAUR_USERS: ${CAUR_USERS:-?err}
      CAUR_VAPID_PUBLIC: BFMijCyTcLZu3HRJyMfoB4vtnDcgl7E2SVZgd4uWB3XjO2VvRh_LjYHcY_oJLvMIhdp5Yvuz0gudRpY-PFI9iWA
      CAUR_VAPID_PRIVATE: ${CAUR_VAPID_PRIVATE:-?err}
      NODE_ENV: production
      PG_DATABASE: chaotic-aur
      PG_HOST: 10.0.5.20
      PG_PASSWORD: ${PG_PASSWORD:-?err}
      PG_USER: chaotic-aur
      REDIS_PASSWORD: ${REDIS_PASSWORD:-?err}
      REDIS_SSH_HOST: host.docker.internal
      REDIS_SSH_USER: package-deployer
    ports: ["3000:3000"]
    volumes: ["${SSH_KEY:-?err}:/app/sshkey", "./backend-config:/app/config"]
    extra_hosts: ["host.docker.internal:host-gateway"]

  # TODO: revert to NixOS service once it no longer segfaults
  database:
    image: redis:8.2-m01-alpine
    container_name: chaotic-database
    restart: always
    ports: ["127.0.0.1:6379:6379"]
    command: redis-server --save 20 1 --loglevel warning --requirepass "${REDIS_PASSWORD:-?err}"
    volumes: ["./database:/data"]

  marge_bot:
    image: registry.gitlab.com/marge-org/marge-bot:main
    container_name: chaotic-marge-
    restart: always
    environment:
      MARGE_AUTH_TOKEN: ${TEMERAIRE_BOT_TOKEN:-?err}
      MARGE_GITLAB_URL: https://gitlab.com
      MARGE_USE_HTTPS: true
      # Scheduled (hourly) 30 */3 * * * UTC
      # Add a 20 minute buffer after each scheduled time to allow time for the pipeline to run
      # Every 3 hours between HH:30 and HH:50
      MARGE_EMBARGO: "Mon@00:30-Mon@00:50,Mon@03:30-Mon@03:50,Mon@06:30-Mon@06:50,Mon@09:30-Mon@09:50,Mon@12:30-Mon@12:50,Mon@15:30-Mon@15:50,Mon@18:30-Mon@18:50,Mon@21:30-Mon@21:50,Tue@00:30-Tue@00:50,Tue@03:30-Tue@03:50,Tue@06:30-Tue@06:50,Tue@09:30-Tue@09:50,Tue@12:30-Tue@12:50,Tue@15:30-Tue@15:50,Tue@18:30-Tue@18:50,Tue@21:30-Tue@21:50,Wed@00:30-Wed@00:50,Wed@03:30-Wed@03:50,Wed@06:30-Wed@06:50,Wed@09:30-Wed@09:50,Wed@12:30-Wed@12:50,Wed@15:30-Wed@15:50,Wed@18:30-Wed@18:50,Wed@21:30-Wed@21:50,Thu@00:30-Thu@00:50,Thu@03:30-Thu@03:50,Thu@06:30-Thu@06:50,Thu@09:30-Thu@09:50,Thu@12:30-Thu@12:50,Thu@15:30-Thu@15:50,Thu@18:30-Thu@18:50,Thu@21:30-Thu@21:50,Fri@00:30-Fri@00:50,Fri@03:30-Fri@03:50,Fri@06:30-Fri@06:50,Fri@09:30-Fri@09:50,Fri@12:30-Fri@12:50,Fri@15:30-Fri@15:50,Fri@18:30-Fri@18:50,Fri@21:30-Fri@21:50,Sat@00:30-Sat@00:50,Sat@03:30-Sat@03:50,Sat@06:30-Sat@06:50,Sat@09:30-Sat@09:50,Sat@12:30-Sat@12:50,Sat@15:30-Sat@15:50,Sat@18:30-Sat@18:50,Sat@21:30-Sat@21:50,Sun@00:30-Sun@00:50,Sun@03:30-Sun@03:50,Sun@06:30-Sun@06:50,Sun@09:30-Sun@09:50,Sun@12:30-Sun@12:50,Sun@15:30-Sun@15:50,Sun@18:30-Sun@18:50,Sun@21:30-Sun@21:50"