README
¶
Nuon
Nuon is an open-source platform for software vendors to deploy and operate their software in their customers' cloud accounts.
This software category is called Bring Your Own Cloud (BYOC).
What is Nuon?
Historically there have been two ways to deploy any software vendor's product: SaaS (in the vendor's cloud) and self-hosted (the customer manually installs the vendor's software in their cloud).
But some customers have compliance and regulatory reasons that require some or all of the vendor's software be installed in the customers' cloud accounts. Customers who self-host would also prefer if the software vendor installed and managed their software versus managing the complexity themselves.
Now there is an emerging deployment alternative called Bring Your Own Cloud (BYOC) where the software vendor installs and manages their software - in their customers' cloud accounts.
Nuon is a platform that software vendors can use to quickly and securely offer BYOC to their customers.
Getting started
The fastest way to get started with Nuon is to sign up for a free trial on Nuon Cloud.
The docs for creating your first app are here. Nuon maintains a list of example apps to test Nuon and install them into AWS. We will add more examples that install into Azure and Google Cloud.
Deployment options
Nuon supports three deployment models:
- Nuon Cloud — Fully managed, multi-tenant SaaS hosted by Nuon. The fastest way to get started; sign up for a free trial.
- Nuon BYOC — Single-tenant Nuon control plane deployed into your AWS account, managed remotely by Nuon. You own the infrastructure and data. See the BYOC docs.
- Nuon Self-Hosted — Deploy and operate Nuon entirely within your own infrastructure, with no dependency on Nuon Cloud. Supported on AWS. See the self-hosted docs.
See the full deployment options guide for a detailed comparison.
Documentation
Checkout our Knowledge Base for commonly asked questions.
Browse our docs here or visit a specific section below:
- Concepts: apps, components, actions, inputs, installs, workflows
- Architecture: control plane, runner, CLI, API
- Deployment options: Nuon Cloud, Nuon BYOC, and Nuon Self-Hosted
- Guides: technical info on component types, actions, variables, and more
Also browse the Nuon blog for technical posts on specific features and example app guides.
Support
Have a technical question? Please open a GitHub issue, or join
our Community Slack — the
help channel is the best place to chat with the team.
Enterprise
Dedicated support and additional security and governance features are available for an annual license fee. Check out our enterprise features here.
Changelog
When Nuon does a promotion to Nuon Cloud, we publish a changelog of new features.
Contributors
Review our contributing guidelines here.
Made with contrib.rocks.
Directories
¶
| Path | Synopsis |
|---|---|
|
bins
|
|
|
cli
command
|
|
|
cli/internal/httpdebug
Package httpdebug provides an http.RoundTripper that traces every request and prints per-phase timings (DNS, connect, TLS, server wait, transfer) to stderr.
|
Package httpdebug provides an http.RoundTripper that traces every request and prints per-phase timings (DNS, connect, TLS, server wait, transfer) to stderr. |
|
cli/internal/oidctoken
Package oidctoken discovers ambient OIDC ID tokens in automation environments (CI) so the CLI can exchange them for Nuon API tokens without any stored secrets.
|
Package oidctoken discovers ambient OIDC ID tokens in automation environments (CI) so the CLI can exchange them for Nuon API tokens without any stored secrets. |
|
cli/internal/services/labels
Package labels provides a shared parser for kubectl-style label arguments used by `nuon installs label`, `nuon components label`, and `nuon actions label`.
|
Package labels provides a shared parser for kubectl-style label arguments used by `nuon installs label`, `nuon components label`, and `nuon actions label`. |
|
cli/internal/services/mcpserver
Package mcpserver runs a stdio MCP server exposing Nuon operations as tools for LLM clients (Claude Code, Claude Desktop, etc).
|
Package mcpserver runs a stdio MCP server exposing Nuon operations as tools for LLM clients (Claude Code, Claude Desktop, etc). |
|
cli/internal/services/orgs/subscriptiontui
pickers.go houses the data-driven entity pickers that fire after the main subscription form (tui.go) when the user selects "specific" for a given kind.
|
pickers.go houses the data-driven entity pickers that fire after the main subscription form (tui.go) when the user selects "specific" for a given kind. |
|
cli/internal/ui/bubbles
Package bubbles owns the CLI's small reusable terminal-UI primitives.
|
Package bubbles owns the CLI's small reusable terminal-UI primitives. |
|
cli/internal/ui/v3
command
|
|
|
cli/internal/ui/v3/action/run/steps
This run.go file contains a stub used to render the step component in a standalone way.
|
This run.go file contains a stub used to render the step component in a standalone way. |
|
cli/internal/ui/v3/common
Package common provides utilities for v3 UI components.
|
Package common provides utilities for v3 UI components. |
|
lsp
command
|
|
|
runner
command
|
|
|
runner/internal/pkg/componenthealth/gitopshealth
Vendored from github.com/argoproj/gitops-engine@v0.7.3/pkg/health (Apache-2.0).
|
Vendored from github.com/argoproj/gitops-engine@v0.7.3/pkg/health (Apache-2.0). |
|
runner/internal/pkg/health
Package health serves a minimal /livez endpoint from the mng process.
|
Package health serves a minimal /livez endpoint from the mng process. |
|
runner/internal/pkg/shutdownbeacon
Package shutdownbeacon reports to the control plane when the runner's host VM is shutting down.
|
Package shutdownbeacon reports to the control plane when the runner's host VM is shutting down. |
|
events/envelope
Package envelope normalizes inbound trigger event payloads.
|
Package envelope normalizes inbound trigger event payloads. |
|
events/provider
Package provider defines the interface an inbound event provider implements: creation-time defaults, envelope decoding, request verification, protocol handshakes, and rejection behavior.
|
Package provider defines the interface an inbound event provider implements: creation-time defaults, envelope decoding, request verification, protocol handshakes, and rejection behavior. |
|
events/providers
Package providers registers the built-in inbound event providers.
|
Package providers registers the built-in inbound event providers. |
|
events/signature
Package signature verifies inbound trigger event authentication material: HMAC request signatures, Slack timestamped signatures, API keys, and basic auth credentials.
|
Package signature verifies inbound trigger event authentication material: HMAC request signatures, Slack timestamped signatures, API keys, and basic auth credentials. |
|
events/sns
Package sns parses and verifies AWS SNS HTTP(S) deliveries: message envelope validation, signing certificate retrieval, RSA signature verification, and subscription URL validation.
|
Package sns parses and verifies AWS SNS HTTP(S) deliveries: message envelope validation, signing certificate retrieval, RSA signature verification, and subscription URL validation. |
|
gen/markdown-docs
command
|
|
|
gen/temporal-gen-v2
command
|
|
|
gen/temporal-gen-v2/lib
Package temporalgen provides a library interface for temporal-gen-v2.
|
Package temporalgen provides a library interface for temporal-gen-v2. |
|
helm/operations
TODO: Is this file needed?
|
TODO: Is this file needed? |
|
labels
Package labels' match.go defines the SubscriptionMatch shape persisted as a nullable JSONB column on slack_channel_subscriptions.
|
Package labels' match.go defines the SubscriptionMatch shape persisted as a nullable JSONB column on slack_channel_subscriptions. |
|
oci/dockerhub
Package dockerhub provides utilities for working with Docker Hub references.
|
Package dockerhub provides utilities for working with Docker Hub references. |
|
oci/imageref
Package imageref renders machine-readable and human-friendly references for image-type component builds.
|
Package imageref renders machine-readable and human-friendly references for image-type component builds. |
|
oci/updatepolicy
Package updatepolicy implements the semver-based tag selection used by image-type component builds when the user has set a `update_policy` constraint.
|
Package updatepolicy implements the semver-based tag selection used by image-type component builds when the user has set a `update_policy` constraint. |
|
policies
Package policies derives stable filenames for Kubernetes policy manifests shipped through the Nuon sandbox Terraform module.
|
Package policies derives stable filenames for Kubernetes policy manifests shipped through the Nuon sandbox Terraform module. |
|
principal
Principal package contains operations related to nuon entity principals like components, actions, sandboxes etc
|
Principal package contains operations related to nuon entity principals like components, actions, sandboxes etc |
|
runner/errcapture
Package errcapture captures a runner job execution's error-level log output so it can be attached to the failed execution result as rich diagnostics.
|
Package errcapture captures a runner job execution's error-level log output so it can be attached to the failed execution result as rich diagnostics. |
|
runner/oci/resolve
Package ociresolve resolves an OCI source reference to its manifest descriptor without copying any bytes.
|
Package ociresolve resolves an OCI source reference to its manifest descriptor without copying any bytes. |
|
runner/op
Package op provides the primitive used to wrap individual tool / SDK call sites so the runner can build a tool-call graph for each job execution.
|
Package op provides the primitive used to wrap individual tool / SDK call sites so the runner can build a tool-call graph for each job execution. |
|
terraform/binary/local
Package local implements a binary.Binary that points at an existing terraform CLI binary on disk.
|
Package local implements a binary.Binary that points at an existing terraform CLI binary on disk. |
|
ui
1.
|
1. |
|
wasm/wrt
Package wrt provides Nuon's standard WASM runtime for executing WebAssembly modules.
|
Package wrt provides Nuon's standard WASM runtime for executing WebAssembly modules. |
|
sdks
|
|
|
auth
module
|
|
|
nuon-go
module
|
|
|
nuon-runner-go
module
|
|
|
stack
module
|
|
|
services
|
|
|
ctl-api
command
|
|
|
ctl-api/cmd/gen
command
|
|
|
ctl-api/cmd/nuontest
command
|
|
|
ctl-api/internal/app/apps/signals/branches/installgroups
Package installgroups resolves an install group to the installs it currently targets, either from its pinned install IDs or by evaluating its label selector.
|
Package installgroups resolves an install group to the installs it currently targets, either from its pinned install IDs or by evaluating its label selector. |
|
ctl-api/internal/app/installs/deployerrors
Package deployerrors holds the typed CompositeError implementations produced by the installs deploy orchestration itself (as opposed to a runner job's tool output, which is parsed under runners/errparse).
|
Package deployerrors holds the typed CompositeError implementations produced by the installs deploy orchestration itself (as opposed to a runner job's tool output, which is parsed under runners/errparse). |
|
ctl-api/internal/app/installs/signals/awaitcomponenthealthy
Package awaitcomponenthealthy holds the verified-deploy stabilization gate: it waits for a component to hold healthy after its apply before the deploy step completes.
|
Package awaitcomponenthealthy holds the verified-deploy stabilization gate: it waits for a component to hold healthy after its apply before the deploy step completes. |
|
ctl-api/internal/app/installs/signals/componenthealthnotify
Package componenthealthnotify holds notification-only carrier signals for the component health axis.
|
Package componenthealthnotify holds notification-only carrier signals for the component health axis. |
|
ctl-api/internal/app/installs/signals/phonehomebackfill
Package phonehomebackfill onboards one install to phone-home auth.
|
Package phonehomebackfill onboards one install to phone-home auth. |
|
ctl-api/internal/app/notebooks/client
Package client dispatches notebook cell runs to the warm, long-lived per-notebook Temporal workflow via update-with-start.
|
Package client dispatches notebook cell runs to the warm, long-lived per-notebook Temporal workflow via update-with-start. |
|
ctl-api/internal/app/notebooks/signals/start
Package start defines the notebook-start queue signal.
|
Package start defines the notebook-start queue signal. |
|
ctl-api/internal/app/orgs/signals/phone_home_backfill
Package phone_home_backfill onboards one org's installs to phone-home auth.
|
Package phone_home_backfill onboards one org's installs to phone-home auth. |
|
ctl-api/internal/app/runners/consumer
Package consumer holds the runners domain's Kafka consumers.
|
Package consumer holds the runners domain's Kafka consumers. |
|
ctl-api/internal/app/runners/errparse
Package errparse turns the raw error output of a failed runner job into a typed compositeerrors.CompositeError.
|
Package errparse turns the raw error output of a failed runner job into a typed compositeerrors.CompositeError. |
|
ctl-api/internal/app/runners/errparse/all
Package all blank-imports every errparse parser package so their init() registrations land in the default registry.
|
Package all blank-imports every errparse parser package so their init() registrations land in the default registry. |
|
ctl-api/internal/app/runners/errparse/aws
Package aws holds the AWS provider-layer CompositeError parsers: cloud error codes surfaced from a runner job's raw output.
|
Package aws holds the AWS provider-layer CompositeError parsers: cloud error codes surfaced from a runner job's raw output. |
|
ctl-api/internal/app/runners/errparse/errparsetest
Package errparsetest provides a shared, table-driven contract runner for errparse parsers.
|
Package errparsetest provides a shared, table-driven contract runner for errparse parsers. |
|
ctl-api/internal/app/runners/errparse/generic
Package generic holds the tool-agnostic, always-matching fallback parser.
|
Package generic holds the tool-agnostic, always-matching fallback parser. |
|
ctl-api/internal/app/runners/errparse/helm
Package helm holds tool-layer CompositeError parsers for helm jobs.
|
Package helm holds tool-layer CompositeError parsers for helm jobs. |
|
ctl-api/internal/app/runners/errparse/terraform
Package terraform holds tool-layer CompositeError parsers for terraform jobs.
|
Package terraform holds tool-layer CompositeError parsers for terraform jobs. |
|
ctl-api/internal/app/slack/service
Package service exposes the org-scoped, dashboard-facing public API for the Slack integration: enumerating installations linked to an org, listing / creating channel subscriptions, and kicking off the OAuth install flow.
|
Package service exposes the org-scoped, dashboard-facing public API for the Slack integration: enumerating installations linked to an org, listing / creating channel subscriptions, and kicking off the OAuth install flow. |
|
ctl-api/internal/pkg/appconfiggraph
Package appconfiggraph builds the component dependency graph of an install's pinned app config and resolves effective-enabled state and cascade ordering over it.
|
Package appconfiggraph builds the component dependency graph of an install's pinned app config and resolves effective-enabled state and cascade ordering over it. |
|
ctl-api/internal/pkg/azureroles
Package azureroles resolves Azure built-in role names to their definition GUIDs.
|
Package azureroles resolves Azure built-in role names to their definition GUIDs. |
|
ctl-api/internal/pkg/compositeerrors
Package compositeerrors defines the typed, embedded error abstraction used across the Nuon platform.
|
Package compositeerrors defines the typed, embedded error abstraction used across the Nuon platform. |
|
ctl-api/internal/pkg/config/build
Package build converts parsed app config into ctl-api database models.
|
Package build converts parsed app config into ctl-api database models. |
|
ctl-api/internal/pkg/configdiff
Package configdiff computes the difference between two app config versions as it applies to a single install.
|
Package configdiff computes the difference between two app config versions as it applies to a single install. |
|
ctl-api/internal/pkg/consumer
Package consumer is the Kafka consumer runtime: consumer naming and selection, the shared ClickHouse-writing sink, and the dead-letter path.
|
Package consumer is the Kafka consumer runtime: consumer naming and selection, the shared ClickHouse-writing sink, and the dead-letter path. |
|
ctl-api/internal/pkg/flow/allgenerators
Package allgenerators registers all workflow step generators into the generateworkflowsteps registry.
|
Package allgenerators registers all workflow step generators into the generateworkflowsteps registry. |
|
ctl-api/internal/pkg/flow/directive
Package directive defines typed directive constants for the workflow step and group execution system.
|
Package directive defines typed directive constants for the workflow step and group execution system. |
|
ctl-api/internal/pkg/installvalidate
Package installvalidate validates an install's desired configuration before it is persisted, surfacing structural problems as a set of diagnostics rather than a single opaque error.
|
Package installvalidate validates an install's desired configuration before it is persisted, surfacing structural problems as a set of diagnostics rather than a single opaque error. |
|
ctl-api/internal/pkg/interests
Package interests defines the shared "what events do you want?" model used by both Slack channel subscriptions and webhooks.
|
Package interests defines the shared "what events do you want?" model used by both Slack channel subscriptions and webhooks. |
|
ctl-api/internal/pkg/operation-roles
operationroles implements various rules around what role to use for a particular operation
|
operationroles implements various rules around what role to use for a particular operation |
|
ctl-api/internal/pkg/queue/catalog/allsignals
Package allsignals imports all signal packages to trigger their init() registrations into the signal catalog.
|
Package allsignals imports all signal packages to trigger their init() registrations into the signal catalog. |
|
ctl-api/internal/pkg/queue/signal/hooks/slackrender
Package slackrender renders Slack message text and blocks for Nuon workflow / workflow_step / workflow_step_approval lifecycle events.
|
Package slackrender renders Slack message text and blocks for Nuon workflow / workflow_step / workflow_step_approval lifecycle events. |
|
ctl-api/internal/pkg/secretsmanager
Package secretsmanager manages the phone-home secret in the management account's AWS Secrets Manager.
|
Package secretsmanager manages the phone-home secret in the management account's AWS Secrets Manager. |
|
ctl-api/internal/pkg/slack/autolink
Package autolink ensures a SlackOrgLink and optional default channel subscription for a single org under the same gating policy the reconciler applies, so org creation and the periodic sweep share one code path.
|
Package autolink ensures a SlackOrgLink and optional default channel subscription for a single org under the same gating policy the reconciler applies, so org creation and the periodic sweep share one code path. |
|
ctl-api/internal/pkg/slack/client
Package client is a thin Slack Web API client scoped to the surface area the Nuon slackbot integration needs:
|
Package client is a thin Slack Web API client scoped to the surface area the Nuon slackbot integration needs: |
|
ctl-api/internal/pkg/slack/signing
Package signing implements verification of incoming Slack webhooks.
|
Package signing implements verification of incoming Slack webhooks. |
|
ctl-api/internal/pkg/slack/statejwt
Package statejwt encodes and decodes the OAuth `state` parameter used in the Slack install / link flows.
|
Package statejwt encodes and decodes the OAuth `state` parameter used in the Slack install / link flows. |
|
ctl-api/internal/pkg/stacks/aws
Package aws renders the install-stacks/aws Terraform module's tfvars file for an AWS install.
|
Package aws renders the install-stacks/aws Terraform module's tfvars file for an AWS install. |
|
dashboard-ui/server
command
|
|
Click to show internal directories.
Click to hide internal directories.