Install Nuon BYOC

​

Prerequisites

​

AWS Account

• us-east-1
• eu-west-1

​

DNS

​

Root DNS

1. Before installation, create the DNS zone my-domain.com if it does not already exist.
2. Provide nuon.my-domain.com as the value for the Root Domain input.
3. Once Nuon BYOC has fully provisioned, the domains of the DNS servers for the install will be available in the outputs.
4. Create an NS record named nuon.my-domain.com, using the DNS server domains as the value.
5. Once propagation is complete, the Nuon Dashboard should be reachable at app.nuon.my-domain.com.

​

Delegation DNS

​

GitHub App

1. Go to GitHub App Settings and click New GitHub App
2. Configure the app with these settings:

3. Set permissions:

4. Under “Where can this GitHub App be installed?”, select Only on this account (unless you need to access repos in other GitHub organizations)
5. Click Create GitHub App
6. After creation, scroll to the bottom and click Generate a private key. Save this PEM file - you’ll need it later.
7. Note your App ID and Client ID from the app settings page.

​

Identity Provider

​

Google

1. Log into your Google Cloud Platform console.
2. Navigate to Google Auth Platform, and open the “Clients” tab.
3. Create a new client named “Nuon BYOC”.
4. Save the client ID and secret.
5. Add an authorized redirect URI with the value, https://auth.<your-root-domain>/auth.

​

Auth0 (DEPRECATED)

module "byoc_auth0" {
  source = "github.com/nuonco/byoc-auth0"
  # Your Auth0 tenant domain
  auth0_domain = "your-tenant.auth0.com"
  # The root domain for your BYOC install
  public_domain = "<your-root-domain>"
  # Your Nuon install ID
  install_id   = "<your-install-id>"
  install_name = "<your-install-name>"
}

1. Go to Actions > Library in your Auth0 dashboard
2. Click Create Action > Build from scratch
3. Name it AddScope and select the latest runtime
4. Replace the code with:

exports.onExecutePostLogin = async (event, api) => {
  const email = event.user.email;
  api.accessToken.setCustomClaim(`email`, email);
};

5. Deploy the action
6. Go to Actions > Triggers > Post Login
7. Drag the AddScope action into the flow and save

1. In Okta, create a new OIDC application
2. Set the Sign In Redirect to <your-auth0-tenant>/login/callback
3. Set Trusted Origins to <your-root-domain>
4. Note the Client ID and Client Secret

1. Go to Authentication > Enterprise > Okta Workforce > Create
2. Configure:
   • Connection name: Choose a unique name
   • Okta domain: Your Okta tenant domain
   • Client ID/Secret: From Step 1
3. Enable Sync user profiles at each login
4. Set User Mapping:

{
  "attributes": {
    "email": "${context.tokenset.email}"
  },
  "mapping_mode": "use_map"
}

​

Inputs

​

Authentication Configuration

​

GitHub Configuration

​

DNS Configuration

​

Database Configuration (Optional)

​

Secrets

base64 -i your-github-app-key.pem

​

Provision

1. Return to your install in the Nuon dashboard
2. Click Reprovision Install from the Manage menu
3. Wait for the provision workflow to complete

​

Configure DNS (Optional)

• A Zone ID for your public domain
• Nameserver records to add to your domain’s DNS

​

Verify Installation

curl https://api.<your-root-domain>/health