Console Sign-in Presentation

Operators can configure a deployment-wide banner and the content presented on the Nexus sign-in page. The console reads this configuration when the server renders the page, so change the Console service environment and restart or roll out that service after an update.

These values are presentation configuration, not tenant data. Keep notices, agreement text, and logos in a reviewed ConfigMap or a read-only mounted file. Do not use them for secrets.

Console banner

The banner is fixed at the top of every Console page. When enabled, the Console reserves its height so page content and the navigation sidebar remain visible below it.

Variable	Required	Behavior
NEXUS_BANNER_ENABLED	Yes	Enable only with the exact lowercase value true. True, TRUE, 1, and yes leave the banner off.
NEXUS_BANNER_TEXT	Yes when enabled	Plain-text banner message.
NEXUS_BANNER_COLOR	No	CSS color name or hex color. Invalid values use the safe amber default.
NEXUS_BANNER_HEIGHT	No	Length above zero with optional px or rem; unitless values are pixels. Default: 28px.

A banner that is enabled but cannot be displayed is a configuration error, not a silent default: if NEXUS_BANNER_ENABLED is true while NEXUS_BANNER_TEXT is empty or NEXUS_BANNER_HEIGHT resolves to zero, the Console refuses to start and names the variable at fault. This keeps a typo from serving an unmarked Console.

Choose a height that can contain the message. The Console scales banner text to the configured height, but very small values necessarily produce very small text.

Sign-in notice

The sign-in page presents an authorized-use notice in the right panel on desktop and below the sign-in controls on smaller screens.

Variable	Required	Behavior
NEXUS_LOGIN_NOTICE_TITLE	No	Notice heading.
NEXUS_LOGIN_NOTICE_BODY	No	Inline Markdown body.
NEXUS_LOGIN_NOTICE_BODY_FILE	No	Path to a file under /workspace/notices. Takes precedence over NEXUS_LOGIN_NOTICE_BODY.
NEXUS_USER_AGREEMENT	No	Agreement statement shown below the sign-in card.
NEXUS_USER_AGREEMENT_LINK_URL	No	Agreement URL. Only https and http URLs render.
NEXUS_USER_AGREEMENT_LINK_LABEL	No	Link text. If empty while the URL is valid, the Console displays the URL itself.

The body file must be a regular file inside /workspace/notices, carry a .md or .txt extension, and be no larger than 64 KiB. Every Console image ships that directory as a read-only mount point, so notice content is delivered by mounting over it. A path outside the directory is refused rather than read, which keeps a mistyped variable from rendering an unrelated file to anonymous visitors. The Console strips a UTF-8 BOM and NUL bytes. If the file is missing, unreadable, or too large, it does not fall back to the inline body.

The body renders as Markdown with HTML disabled, and images and links are restricted to the Console’s own origin. A notice cannot execute script or load a remote asset from the sign-in page.

Long bodies use a bounded reader with a scrollbar and a visible reading cue. This avoids allowing a notice to make the sign-in page itself scroll.

Sign-in title and logo

The SSO-only sign-in layout shows the logo, then the sign-in title, then the provider button. The default logo is the Nexus asset packaged into the Console image.

Variable	Required	Behavior
NEXUS_SIGN_IN_TITLE	No	Override for Sign in to Nexus. Empty uses the default.
NEXUS_LOGO	No	Override logo as an image/png, image/jpeg, image/webp, or image/gif data URI, or a path under /workspace/notices with a matching extension.

Logo overrides are limited to 512 KiB. Invalid, unsupported, oversized, or unreadable overrides fall back to the packaged Nexus logo. File-based overrides follow the same rule as the notice body: the path must resolve inside /workspace/notices, which every Console image ships as a read-only mount point.

Deployment examples

Compose

Place non-secret local values in .env:

NEXUS_BANNER_ENABLED=true
NEXUS_BANNER_TEXT="AUTHORIZED USE ONLY"
NEXUS_BANNER_COLOR="#1d4ed8"
NEXUS_BANNER_HEIGHT=28
NEXUS_LOGIN_NOTICE_TITLE="Authorized Use Notice"
NEXUS_LOGIN_NOTICE_BODY_FILE="/workspace/notices/authorized-use.md"
NEXUS_USER_AGREEMENT="By signing in, you acknowledge the user agreement."
NEXUS_USER_AGREEMENT_LINK_URL="https://example.org/user-agreement"
NEXUS_USER_AGREEMENT_LINK_LABEL="Read the user agreement"
NEXUS_SIGN_IN_TITLE="Sign in to Nexus"
NEXUS_LOGO="/workspace/notices/nexus-logo.png"

Mount the referenced files over the image’s /workspace/notices directory. Add to the console service in deploy/compose/docker-compose.yml, or to a compose override file:

services:
    console:
        volumes:
            - ./notices:/workspace/notices:ro

Then recreate the service:

just compose up -d --force-recreate console

Kubernetes and OpenShift

Set the values as environment variables on the Console Deployment. Deliver BODY_FILE and file-based NEXUS_LOGO content through a ConfigMap or another approved read-only volume mounted at /workspace/notices, and set the variables to paths inside it. After changing the Deployment or referenced ConfigMap, roll out the Console Deployment and confirm the sign-in page renders the intended banner, notice, agreement, and logo.

volumeMounts:
    - name: console-notices
      mountPath: /workspace/notices
      readOnly: true
volumes:
    - name: console-notices
      configMap:
          name: console-notices

Verification

1. Open the Console sign-in route in a desktop browser and a narrow mobile viewport.
2. Confirm the banner text, color, and height are legible and no content sits behind it.
3. Confirm the notice body renders, long notices scroll inside their panel, and the reading cue is visible.
4. Confirm the agreement link opens only the intended https or http destination.
5. Confirm an empty agreement-link label displays the URL and an empty title falls back to Sign in to Nexus.
6. Confirm the banner appears on an authenticated page as well as the sign-in route, so the marking covers the whole Console rather than one entry point.