Add NicApp CRD template for NIC integration

- Add templates/nicapp.yaml for nebari-operator integration
- Add nicapp config block to values.yaml (enabled by default)
- Configures routing, TLS, and Keycloak auth via operator
- Set nicapp.enabled=false when deploying outside NIC

Author: aktech

templates/nicapp.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.nicapp.enabled }}
+apiVersion: apps.nic.nebari.dev/v1
+kind: NicApp
+metadata:
+  name: {{ include "data-science-pack.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "data-science-pack.labels" . | nindent 4 }}
+spec:
+  hostname: {{ required "nicapp.hostname is required when nicapp.enabled is true" .Values.nicapp.hostname }}
+  service:
+    name: {{ include "data-science-pack.fullname" . }}-proxy-public
+    port: {{ .Values.nicapp.service.port | default 80 }}
+  {{- with .Values.nicapp.tls }}
+  tls:
+    enabled: {{ .enabled | default true }}
+    mode: {{ .mode | default "wildcard" }}
+  {{- end }}
+  {{- with .Values.nicapp.auth }}
+  auth:
+    enabled: {{ .enabled | default true }}
+    provider: {{ .provider | default "keycloak" }}
+    provisionClient: {{ .provisionClient | default true }}
+  {{- end }}
+  gateway: {{ .Values.nicapp.gateway | default "public" }}
+{{- end }}

values.yaml

@@ -1,6 +1,25 @@
 # Default values for nebari-data-science-pack
 # This is a YAML-formatted file.
 
+# =============================================================================
+# NIC (Nebari Infrastructure Core) Integration
+# =============================================================================
+# Creates a NicApp CRD that configures routing, TLS, and auth via nebari-operator.
+# Set to false when deploying outside of NIC.
+nicapp:
+  enabled: true
+  # hostname: jupyter.nic.local  # Required when enabled
+  gateway: public
+  service:
+    port: 80
+  tls:
+    enabled: true
+    mode: wildcard  # or "dedicated" for per-app certs
+  auth:
+    enabled: true
+    provider: keycloak
+    provisionClient: true
+
 # Shared storage configuration (disabled - requires RWX storage class)
 sharedStorage:
   enabled: false