Configuration Guide

Overview

Your DSOP deployment includes several template files that need to be customized with your environment-specific values:

• values-template.yaml - Main Helm values with <placeholder> values
• config/nexus/ldap-example.json - LDAP configuration template
• config/nexus/ldap-example.cnf - Certificate generation config template
• templates/gitea/oauth-secret-example.yaml - OAuth secret template

Step 1: Configure Template Files

Replace all <placeholder> values in the template files with your actual environment values:

1.1 Update values-template.yaml

cp values-template.yaml values.yaml

Edit values.yaml and replace placeholders like:

• <your-hostname> with your actual hostname
• <your-domain> with your domain
• <ip-address> with actual IP addresses
• Any other <placeholder> values

1.2 Update LDAP Configuration

cp config/nexus/ldap-example.json config/nexus/ldap.json

Edit config/nexus/ldap.json and replace:

• <ldap-host> with your LDAP server hostname
• <domain> with your domain
• <username> and <password> with actual credentials
• Any other <placeholder> values

1.3 Update Certificate Configuration

cp config/nexus/ldap-example.cnf config/nexus/certs/ldap.cnf

Edit config/nexus/certs/ldap.cnf and replace:

• <your-domain> with your actual domain
• <common-name> with the appropriate CN
• Any other <placeholder> values

1.4 Update OAuth Secret (if using Gitea OAuth)

cp templates/gitea/oauth-secret-example.yaml templates/gitea/oauth-secret.yaml
rm templates/gitea/oauth-secret-example.yaml

Edit templates/gitea/oauth-secret.yaml and replace:

• <client-id> with your OAuth client ID
• <client-secret> with your OAuth client secret
• Any other <placeholder> values

Step 2: Generate Certificates

Prerequisites

• OpenSSL installed
• jq installed (for extracting values from JSON)
• Your ldap.json file configured from Step 1

Certificate Generation Process

1. Prepare the certificate config file:

   Your config/nexus/certs/ldap.cnf should define the distinguished name, required extensions (key usage, EKU), and Subject Alternative Names (SANs):

   [req]
   prompt = no
   default_md = sha256
   distinguished_name = dn
   req_extensions = req_ext
   
   [dn]
   CN = *.yourdomain.com
   
   [req_ext]
   subjectAltName = @alt_names
   
   [alt_names]
   DNS.1 = *.yourdomain.com
   
   [v3_server]
   basicConstraints = CA:FALSE
   keyUsage = critical, digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth
   subjectAltName = @alt_names

2. Run the certificate generation script:

   From the dsop directory, run:

   sh config/nexus/ldap-generate-cert.sh

   This will generate:

   • ldap.key - Private key
   • ldap.csr - Certificate signing request
   • ldap.pem - Certificate with proper extensions (serverAuth, SANs)
   • ldap.pfx - PKCS#12 format for Windows/Java import

3. Certificate troubleshooting:

   • Ensure the config/nexus/certs/ directory exists before running the script
   • If you see errors about extensions or SANs, check the format of your ldap.cnf file
   • If files are not being ignored by git, add config/nexus/certs/ to your .gitignore

4. Customization:

   • Edit ldap.cnf to match your domain and requirements

Step 3: Update Nexus Configuration

The LDAPS certificate for Nexus is managed through:

1. Update import the certificate into your LDAP server

2. Upgrade the Helm release:

   helm install dsop .

Step 4: Verify Configuration

1. Check service logs:

   kubectl logs -l app.kubernetes.io/name=nexus-repository-manager -f
   kubectl logs -l app.kubernetes.io/name=gitea -f

2. Test connections:

   • Access Nexus UI and verify LDAP connection works
   • Access Gitea UI and verify OAuth/LDAP authentication
   • Test any other configured integrations

Template Files Reference

File	Purpose	Key Placeholders
values-template.yaml	Main Helm values	<hostname>, <domain>, <ip-address>
config/nexus/ldap-example.json	LDAP config	<ldap-host>, <domain>, <username>, <password>
config/nexus/ldap-example.cnf	Cert config	<your-domain>, <common-name>
templates/gitea/oauth-secret-example.yaml	OAuth secret	<client-id>, <client-secret>

Troubleshooting

• Configuration errors: Double-check that all <placeholder> values have been replaced
• Certificate issues: Ensure the certificate matches your configured hostnames
• Connection issues: Verify network connectivity and DNS resolution
• Authentication failures: Check credentials and LDAP/OAuth configuration

---

Important: Always replace ALL <placeholder> values in template files before deployment to avoid configuration errors.