apps/nubus

Univention Nubus — LDAP / Keycloak / UMC / Portal / NATS / provisioning stack. We are a Univention reseller; this is the canonical IDP we offer to tenants.

Status: scaffold pending. Phase 1 mines proxy-platform-apps/values.nubus.yaml and proxy-platform-apps/postgres-cluster.yaml to produce sanitised base-values.yaml + manifests/cluster.yaml here.

Upstream

• Chart: oci://artifacts.software-univention.de/nubus/charts/nubus
• Version (current): 1.19.0
• Upstream docs: https://docs.software-univention.de/nubus/

Known issues to bake in

These were workarounds in the test deploy. Capture each as either a values choice in base-values.yaml or a manifest in manifests/ so the rebuild is clean:

Issue	Mitigation in this blueprint
Wrong key nubusLdapServer.ldap.auth.password (chart accepts ldapServer.auth.password)	Use the correct key in base-values.yaml
ConfigMap nubus-ldap-server-status persists initialized across restarts	Add cleanup Job (jobs/reset-ldap-init.yaml) — only needed for re-installs
global.secrets.masterPassword required (not optional)	Always set; pulled from ExternalSecret
UDM REST API caches LDAP creds at startup, must be restarted post-LDAP-init	Encode as Helm post-install hook
Rootless LDAP container can't access Longhorn PVC root-owned mount	Set securityContext.fsGroup: 102 on the LDAP statefulset (replaces the chown script)
@ in the notifications PG password breaks libpq URL parsing	Constraint on the Passbolt entry: no @ in the notifications password
Bundled MinIO disabled, external Hetzner S3 used for portal assets	minio.enabled: false, point nubusPortalServer/Listener/Consumer.objectStorage at bbopen-objects (ADR-0010)
Multiple Ingresses targeting same hostname with different TLS secrets cause Cilium-Envoy NACK	Force all portal-domain Ingresses to a single TLS secret name in values
UCR keys missing (umc/saml/idp-server)	Set global.configUcr from base-values.yaml
Both nubusKeycloak and keycloak value sections required	Both filled in base-values.yaml

Files (planned for Phase 1)

• kustomization.yaml — combines manifests + jobs + sets common labels.
• base-values.yaml — Helm values: defaults, no tenant-specific hostnames or secrets.
• manifests/cluster.yaml — CNPG Cluster template (3 instances, longhorn, S3 backup).
• manifests/scheduled-backup.yaml — daily backup CR.
• manifests/external-secrets.yaml — ESO ExternalSecret references for all credentials.
• manifests/networkpolicy-app.yaml — app-specific NetworkPolicy additions on top of tenant baseline.
• jobs/post-install-validate.yaml — smoke test after Helm install.

Tenants using this app

• tenants/bb-open/apps/nubus/ — internal-and-eat-our-own-dogfood deploy at nubus.bb-open.com.