Nexus Repository Manager: Setup, Docker Registry, and Maven/npm Proxy

Why You Need an Artifact Repository

Pulling packages from the internet on every build is slow, unreliable, and a security risk. Nexus Repository Manager solves this:

• Proxy repositories: Cache upstream registries (Docker Hub, Maven Central, npmjs.com) locally
• Hosted repositories: Store your own artifacts, Docker images, and build outputs
• Group repositories: Combine proxy + hosted under one URL so clients don't need to know the difference

One Nexus instance replaces direct access to Docker Hub, Maven Central, PyPI, npm, and NuGet for your entire team.

---

Installation (Docker)

The fastest way to run Nexus:

# Create a persistent data directory
mkdir -p /opt/nexus/data
chown -R 200:200 /opt/nexus/data   # UID 200 is the nexus user inside the container

# Run Nexus
docker run -d \
  --name nexus \
  --restart unless-stopped \
  -p 8081:8081 \
  -p 8082:8082 \   # Docker hosted registry port
  -p 8083:8083 \   # Docker proxy registry port
  -v /opt/nexus/data:/nexus-data \
  sonatype/nexus3:latest

# Get initial admin password
docker exec nexus cat /nexus-data/admin.password

Access at http://your-server:8081. Login with admin and the password above, then set a new password.

Installation on Linux (Non-Docker)

# Download from https://www.sonatype.com/products/sonatype-nexus-repository (free OSS version)
wget https://download.sonatype.com/nexus/3/nexus-3.75.0-01-unix.tar.gz
tar -xzf nexus-3.75.0-01-unix.tar.gz -C /opt/
ln -s /opt/nexus-3.75.0-01 /opt/nexus

# Create nexus user
useradd -r -m -s /bin/bash nexus
chown -R nexus:nexus /opt/nexus /opt/sonatype-work

# Start
sudo -u nexus /opt/nexus/bin/nexus start

# Enable as systemd service
cat > /etc/systemd/system/nexus.service << 'EOF'
[Unit]
Description=Sonatype Nexus Repository Manager
After=network.target

[Service]
Type=forking
User=nexus
ExecStart=/opt/nexus/bin/nexus start
ExecStop=/opt/nexus/bin/nexus stop
Restart=on-abort
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable --now nexus

---

Configuring Repository Types

Nexus has three repository types:

• Hosted: Store your own artifacts
• Proxy: Cache a remote repository
• Group: Virtual repo combining multiple hosted/proxy repos

Docker: Hosted Registry (Store Your Images)

1. Go to Settings → Repositories → Create repository
2. Choose docker (hosted)
3. Set HTTP port to 8082
4. Enable Docker V1 API if you need compatibility

Test:

docker login your-nexus-server:8082
docker tag myapp:latest your-nexus-server:8082/myapp:latest
docker push your-nexus-server:8082/myapp:latest

Docker: Proxy Registry (Cache Docker Hub)

1. Create repository → docker (proxy)
2. Set Remote storage to https://registry-1.docker.io
3. Set Docker Index to Use Docker Hub
4. HTTP port: 8083

Configure Docker daemon to use Nexus proxy:

# /etc/docker/daemon.json
{
  "insecure-registries": ["your-nexus-server:8083"],
  "registry-mirrors": ["http://your-nexus-server:8083"]
}

sudo systemctl restart docker

Maven: Proxy + Hosted + Group

Proxy (cache Maven Central):

• Recipe: maven2 (proxy)
• Remote URL: https://repo1.maven.org/maven2/
• Version policy: Release

Hosted (store your internal artifacts):

• Recipe: maven2 (hosted)
• Deployment policy: Allow redeploy (for SNAPSHOT) or Disable redeploy (for releases)

Group (unified URL for developers):

• Recipe: maven2 (group)
• Group members: Add hosted + proxy

Configure in ~/.m2/settings.xml:

<settings>
  <mirrors>
    <mirror>
      <id>nexus</id>
      <mirrorOf>*</mirrorOf>
      <url>http://your-nexus-server:8081/repository/maven-group/</url>
    </mirror>
  </mirrors>
  <servers>
    <server>
      <id>nexus</id>
      <username>developer</username>
      <password>yourpassword</password>
    </server>
  </servers>
</settings>

npm: Proxy + Hosted + Group

Proxy (cache npmjs.com):

• Recipe: npm (proxy)
• Remote URL: https://registry.npmjs.org

Hosted (internal packages):

• Recipe: npm (hosted)

Configure npm client:

# Set npm registry to Nexus group
npm config set registry http://your-nexus-server:8081/repository/npm-group/

# For publishing to hosted repo
npm config set //your-nexus-server:8081/repository/npm-hosted/:_authToken <token>
npm publish --registry http://your-nexus-server:8081/repository/npm-hosted/

---

Access Control

Nexus uses roles → privileges → repository permissions.

Create a Read-Only User (CI/CD)

1. Settings → Security → Roles → Create role: ci-reader

   • Privileges: nx-repository-view-*-*-read, nx-repository-view-*-*-browse

2. Settings → Security → Users → Create user: ci-user

   • Assign role: ci-reader

CI/CD Pipeline Authentication

# Docker
docker login your-nexus-server:8082 -u ci-user -p cipassword

# Maven (in pom.xml distributionManagement)
<distributionManagement>
  <snapshotRepository>
    <id>nexus</id>
    <url>http://your-nexus-server:8081/repository/maven-snapshots/</url>
  </snapshotRepository>
  <repository>
    <id>nexus</id>
    <url>http://your-nexus-server:8081/repository/maven-releases/</url>
  </repository>
</distributionManagement>

# npm
npm set //your-nexus-server:8081/repository/npm-hosted/:_auth $(echo -n "ci-user:cipassword" | base64)

---

Cleanup Policies

Artifacts accumulate. Configure cleanup policies to manage disk:

1. Settings → Repository → Cleanup Policies → Create policy
   • Format: Docker
   • Criteria: Last downloaded before 90 days AND last modified before 90 days
2. Assign the policy to your Docker hosted repository
3. Administration → Tasks → Create task → "Repository Cleanup" — schedule it daily

---

Blob Store Management

Blob stores are where Nexus physically stores artifacts. By default, everything goes to the default blob store. Separate blob stores per repository type for easier disk management:

1. Settings → Blob Stores → Create

   • Type: File
   • Path: /opt/nexus-data/blobs/docker

2. Assign the blob store when creating/editing a repository

---

Reverse Proxy (Nginx)

Put Nexus behind Nginx for SSL:

server {
    listen 443 ssl;
    server_name nexus.example.com;

    ssl_certificate /etc/letsencrypt/live/nexus.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nexus.example.com/privkey.pem;

    client_max_body_size 2G;  # allow large artifact uploads

    location / {
        proxy_pass http://127.0.0.1:8081;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Update Nexus base URL: Settings → System → Base URL → https://nexus.example.com

---

Useful Admin Tasks

# Check Nexus logs
tail -f /opt/sonatype-work/nexus3/log/nexus.log
# Docker:
docker logs -f nexus

# Rebuild search index (if search is broken)
# Admin → Support → Tasks → "Rebuild repository search"

# Force garbage collection (remove orphaned files)
# Admin → Support → Tasks → "Delete orphaned asset blobs from blob store"