diff --git a/configs/templates/nco/approved_list.txt b/configs/templates/nco/approved_list.txt
new file mode 100644
index 000000000..3fcdd8216
--- /dev/null
+++ b/configs/templates/nco/approved_list.txt
@@ -0,0 +1,225 @@
+awscli
+bacio
+boost
+bufr
+bufr_dump
+bufr_tranjb
+bufr_util
+cairo
+cdo
+cfitsio
+cfp
+cmake
+cray-parallel-netcdf
+crtm
+curl
+degrib
+dumpmb
+ecflow
+eigen
+emapf-c
+esmf
+fms
+g2
+g2c
+g2tmpl
+gdal
+gempak
+geos
+gfsio
+git
+grib_util
+gsl
+hdf5
+imagemagick
+ip
+ip2
+jasper
+lamp_shared
+landsfcutil
+libdap4
+libgeotiff
+libiconv
+libjpeg
+libjpeg-turbo
+libpng
+libtiff
+libxml2
+libxmlparse
+libxrender
+madis
+manic
+mapl
+mbedtls
+met
+metis
+metplus
+mos_shared
+nco
+ncview
+nemsio
+nemsiogfs
+netcdf
+perl
+pigz
+pio
+pixman
+prepobs
+prod_envir
+prod_util
+proj
+python
+readline
+rsync
+schism
+scotch
+sfcio
+sigio
+sp
+subversion
+udunits
+upp
+util_shared
+w3emc
+w3nco
+wgrib2
+wrf_io
+xyz2shp
+xz
+zlib
+antlr
+apr
+apr-util
+autoconf
+automake
+bdftopcf
+berkeley-db
+bison
+bzip2
+ca-certificates-mozilla
+diffutils
+elfutils
+expat
+fftw
+findutils
+flex
+font-util
+fontconfig
+fontsproto
+freetype
+fribidi
+gdbm
+gettext
+glib
+gmake
+gnuconfig
+gobject-introspection
+gperf
+harfbuzz
+help2man
+icu4c
+inputproto
+json-c
+kbproto
+libaec
+libbsd
+libedit
+libffi
+libfontenc
+libice
+libidn2
+libmd
+libpthread-stubs
+libsigsegv
+libsm
+libtool
+libunistring
+libwebp
+libx11
+libxau
+libxaw
+libxcb
+libxcrypt
+libxdmcp
+libxext
+libxfont
+libxmu
+libxpm
+libxt
+libyaml
+lz4
+m4
+meson
+mkfontdir
+mkfontscale
+nasm
+ncurses
+netcdf-cxx4
+ninja
+openblas
+openssh
+openssl
+pango
+pcre
+pcre2
+pkgconf
+popt
+py-botocore
+py-bottleneck
+py-cftime
+py-colorama
+py-cython
+py-docutils
+py-flit-core
+py-jmespath
+py-netcdf4
+py-numexpr
+py-numpy
+py-packaging
+py-pandas
+py-pip
+py-pyasn1
+py-python-dateutil
+py-pytz
+py-pyyaml
+py-rsa
+py-s3transfer
+py-setuptools
+py-setuptools-scm
+py-setuptools-scm-git-archive
+py-six
+py-tomli
+py-typing-extensions
+py-urllib3
+py-versioneer
+py-wheel
+py-xarray
+qt
+re2c
+renderproto
+sqlite
+tar
+unixodbc
+utf8proc
+util-linux-uuid
+util-macros
+which
+xcb-proto
+xextproto
+xproto
+xtrans
+xxhash
+zstd
+atlas
+eckit
+fckit
+gsl-lite
+qhull
+gftl-shared
+nccmp
+cray-mpich
+gcc-runtime
+glibc
+parallelio
+pkg-config
+ecbuild
diff --git a/configs/templates/nco/spack.yaml b/configs/templates/nco/spack.yaml
new file mode 100644
index 000000000..12787de13
--- /dev/null
+++ b/configs/templates/nco/spack.yaml
@@ -0,0 +1,140 @@
+spack:
+  concretizer:
+    unify: when_possible
+
+  config:
+    install_tree:
+      root: $env/install
+  modules:
+    default:
+      roots:
+        lmod: $env/install/modulefiles
+        tcl: $env/install/modulefiles
+
+  view: false
+  include: []
+
+  specs:
+  - awscli
+  - bacio
+  - boost
+  - bufr
+  - cairo
+  - cdo
+  - cfitsio
+  - cmake
+  - crtm
+  - curl
+  - ecflow
+  - eckit
+  - ecmwf-atlas
+  - eigen
+  - esmf
+  - fckit
+  - fms
+  - g2
+  - g2c
+  - g2tmpl
+  - gdal
+  - geos
+  - gfsio
+  - gftl-shared
+  - git
+  - grib-util
+  - gsl
+  - gsl-lite
+  - hdf5
+  - imagemagick
+  - ip
+  - ip2
+  - jasper
+  - landsfcutil
+  - libgeotiff
+  - libiconv
+  - libjpeg-turbo
+  - libpng
+  - libtiff
+  - libxml2
+  - libxrender
+  - madis
+  - mapl
+  - mbedtls
+  - met
+  - metis
+  - metplus
+  - nccmp
+  - gsi-ncdiag
+  - nco
+  - ncview
+  - nemsio
+  - nemsiogfs
+  - netcdf-c
+  - netcdf-fortran
+  - perl
+  - pigz
+  - parallelio
+  - pixman
+  - proj
+  - python
+  - qhull
+  - readline
+  - rsync
+  - scotch
+  - sfcio
+  - sigio
+  - sp
+  - subversion
+  - udunits
+  - upp
+  - w3emc
+  - w3nco
+  - wgrib2
+  - wrf-io
+
+  packages:
+    # Strictly set virtual package providers:
+    mpi:
+      require: cray-mpich
+    fftw-api:
+      require: fftw
+    blas:
+      require: openblas
+    lapack:
+      require: openblas
+    jpeg:
+      require: libjpeg-turbo
+    # Individual package settings.
+    # Use `require::` to override require's from {common,site}/packages.yaml,
+    # and `require:<newline>  - '...'` to add to existing ones.
+    cdo:
+      require:
+      - 'grib2=none' # avoids eccodes/grib-api dependency
+    curl:
+      require:
+      - '~nghttp2' # avoid nghttp2 dependency
+    ecmwf-atlas:
+      require:: '@0.33.0 +fckit ~trans ~fftw' # disabling trans and fftw to minimize dependencies; older version because newer eckit doesn't build with intel@19
+    esmf:
+      require:
+      - 'snapshot=none' # make sure spack-stack doesn't accidentally give us a beta snapshot
+    fckit:
+      require:: '@0.10.1 +eckit' # older version needed for older eckit & ecmwf-atlas
+    glib:
+      require: '@:2.74.3' # newer versions don't build with intel@19
+    mapl:
+      require:
+      - '~pflogger ~fargparse ~extdata2g' # minimize dependencies
+    netcdf-c:
+      require:: '@4.9.2 +mpi ~parallel-netcdf ~dap ~blosc ~szip build_system=autotools' # disabling dap prevents network access; disabling blosc and szip reduces dependencies
+    py-pandas:
+      require:: '~excel' # minimize dependencies
+    subversion:
+      require:
+      - '~serf +pic' # avoid serf dependency
+    # Explicitly require gcc when needed so Spack won't do anything weird:
+    boost:
+      require: '%gcc'
+    gcc-runtime:
+      require: '%gcc'
+    harfbuzz:
+      require: '%gcc'