Examples

August 2, 2026 ยท View on GitHub

See setup to configure the required infrastructure.

Validation

Cost Center

This example demonstrates a validator that checks whether a job contains cost-center metadata and whether the code starts with cccode-.

Cost-center validator.

(cd example1 && ../../nacp -config example1.conf.hcl)
NOMAD_ADDR=http://localhost:6464 nomad job run example1/example1.nomad

https://user-images.githubusercontent.com/1607547/227664253-d65cd5d4-12e4-4b99-9143-4a346911b7dd.mov

Image Validation via Notation

See the README in the notation/ folder.

Mutator

Simple Hello World

This example demonstrates a simple mutator that adds a hello key to the job meta data with the value world.

simple hello world mutator

(cd example2 && ../../nacp -config example2.conf.hcl)
NOMAD_ADDR=http://localhost:6464 nomad job run example2/example2.nomad

https://user-images.githubusercontent.com/1607547/227664271-cc1b82a2-d5ec-4afe-94df-b6702700cf98.mov

Postgres Env Template Injection

In this example the mutator checks whether a job task contains a postgres metadata field. If so, it injects a template block and Vault policy that render the PostgreSQL connection details.

If the postgres metadata equals native it creates a template that renders the environment variables PGHOST, PGPORT, PGUSER, PGPASSWORD and PGDATABASE.

If the postgres metadata equals springboot it creates a template that renders the environment variables SPRING_DATASOURCE_URL, SPRING_DATASOURCE_USERNAME and SPRING_DATASOURCE_PASSWORD.

PostgreSQL environment-template mutator

(cd example3 && ../../nacp -config example3.conf.hcl)
NOMAD_ADDR=http://localhost:6464 nomad job run example3/example3.nomad

https://user-images.githubusercontent.com/1607547/227664282-e2ee22fc-946f-4b0f-9bfc-d275300dcec5.mov

OAuth2 Proxy Injection

This example deploys a job containing a simple web application.

If a task group's secure metadata names a service such as webapp, the mutator injects oauth2-proxy and rewrites the service so incoming requests pass through the proxy.

(cd example4 && ../../nacp -config example4.conf.hcl)
terraform init && terraform apply -auto-approve
NOMAD_ADDR=http://localhost:6464 nomad job run example4/example4.nomad

OAuth2-proxy mutator

https://user-images.githubusercontent.com/1607547/227664325-768c8b5f-a991-4467-89e5-26a211c3511c.mov

Infrastructure Setup

Run Vault

cd infra/vault
vault server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8200
cd infra/nomad
sudo nomad agent -dev -bind=0.0.0.0 -network-interface=en0 -config=conf

Deploy some infrastructure (keycloak, postgres, treafik)

cd infra/nomad/jobs
terraform init && terraform apply -auto-approve

Configure Postgres Database Engine Vault

cd infra/vault
terraform init && terraform apply -auto-approve

These example assume that every nomad job that comes with a service is accessible via <service_name>.nomad.local Use consul catalog to update /etc/hosts

cd infra/etchosts
./run.sh

(If you trust my script that requires sudo and writes to /etc/hosts ;) )

Notes

The examples are not meant to be used in production. They are just meant to demonstrate the capabilities of nacp and opa.