Install and configure Nexus Repository Manager for private Docker and Maven repositories

Update system packages

Start by updating your package manager to ensure you get the latest versions of dependencies.

sudo apt update && sudo apt upgrade -y

sudo dnf update -y

Install Java 17

Nexus Repository Manager requires Java 17 or later. Install OpenJDK 17 which provides the required runtime environment.

sudo apt install -y openjdk-17-jdk wget unzip

sudo dnf install -y java-17-openjdk java-17-openjdk-devel wget unzip

Verify Java installation:

java -version

Create Nexus user and directories

Create a dedicated system user for Nexus and set up the required directory structure with proper permissions.

sudo useradd --system --no-create-home --shell /bin/false nexus
sudo mkdir -p /opt/nexus /opt/sonatype-work
sudo chown nexus:nexus /opt/nexus /opt/sonatype-work

Download and install Nexus Repository Manager

Download the latest Nexus OSS release and extract it to the installation directory.

cd /tmp
wget https://download.sonatype.com/nexus/3/latest-unix.tar.gz
sudo tar -xzf latest-unix.tar.gz -C /opt/
sudo mv /opt/nexus-3.* /opt/nexus/nexus-3
sudo ln -s /opt/nexus/nexus-3 /opt/nexus/current
sudo chown -R nexus:nexus /opt/nexus /opt/sonatype-work

Configure Nexus JVM settings

Optimize Java memory settings for production use. Adjust these values based on your server's available RAM.

-Xms2g
-Xmx2g
-XX:MaxDirectMemorySize=3g
-XX:+UnlockExperimentalVMOptions
-XX:+UseCGroupMemoryLimitForHeap
-XX:+UseG1GC
-XX:+UseStringDeduplication
-Dkaraf.home=.
-Dkaraf.base=.
-Dkaraf.etc=etc/karaf
-Djava.util.logging.config.file=etc/karaf/java.util.logging.properties
-Dkaraf.data=../sonatype-work/nexus3
-Dkaraf.log=../sonatype-work/nexus3/log
-Djava.io.tmpdir=../sonatype-work/nexus3/tmp

Set proper ownership on the configuration file:

sudo chown nexus:nexus /opt/nexus/current/bin/nexus.vmoptions

Configure Nexus application properties

Set the data directory location and configure basic application settings.

# Nexus default properties
nexus.port=8081
nexus.host=0.0.0.0
nexus.context-path=/

Data directory
karaf.data=/opt/sonatype-work/nexus3
karaf.log=/opt/sonatype-work/nexus3/log

Create systemd service

Set up a systemd service to manage Nexus startup, shutdown, and automatic restart on boot.

[Unit]
Description=Nexus Repository Manager
After=network.target

[Service]
Type=forking
LimitNOFILE=65536
ExecStart=/opt/nexus/current/bin/nexus start
ExecStop=/opt/nexus/current/bin/nexus stop
User=nexus
Restart=on-abort
TimeoutSec=600

[Install]
WantedBy=multi-user.target

Configure Nexus to run as the nexus user:

echo 'run_as_user="nexus"' | sudo tee /opt/nexus/current/bin/nexus.rc
sudo systemctl daemon-reload
sudo systemctl enable nexus
sudo systemctl start nexus

Configure firewall

Open the required ports for Nexus web interface and Docker registry access.

sudo ufw allow 8081/tcp
sudo ufw allow 8082/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo firewall-cmd --permanent --add-port=8081/tcp
sudo firewall-cmd --permanent --add-port=8082/tcp
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Initial Nexus setup

Wait for Nexus to start completely, then retrieve the initial admin password.

sudo journalctl -u nexus -f

Once you see "Started Sonatype Nexus OSS" in the logs, retrieve the admin password:

sudo cat /opt/sonatype-work/nexus3/admin.password

Install and configure NGINX

Set up NGINX as a reverse proxy to handle SSL termination and provide better performance.

sudo apt install -y nginx certbot python3-certbot-nginx

sudo dnf install -y nginx certbot python3-certbot-nginx

Configure NGINX for Nexus

Create a virtual host configuration for Nexus with Docker registry support.

upstream nexus {
    server 127.0.0.1:8081;
}

upstream docker-registry {
    server 127.0.0.1:8082;
}

server {
    listen 80;
    server_name nexus.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name nexus.example.com;
    
    client_max_body_size 1G;
    
    ssl_certificate /etc/letsencrypt/live/nexus.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nexus.example.com/privkey.pem;
    
    location / {
        proxy_pass http://nexus;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        send_timeout 300;
    }
}

server {
    listen 80;
    server_name docker.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name docker.example.com;
    
    client_max_body_size 0;
    chunked_transfer_encoding on;
    
    ssl_certificate /etc/letsencrypt/live/docker.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/docker.example.com/privkey.pem;
    
    location / {
        proxy_pass http://docker-registry;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        send_timeout 300;
    }
}

Enable NGINX configuration and obtain SSL certificates

Enable the site configuration and obtain Let's Encrypt SSL certificates.

sudo ln -s /etc/nginx/sites-available/nexus /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl enable nginx
sudo systemctl start nginx

Obtain SSL certificates (replace with your actual domain names):

sudo certbot --nginx -d nexus.example.com -d docker.example.com

Access Nexus web interface

Open your web browser and navigate to https://nexus.example.com. Log in with username "admin" and the password from the admin.password file.

Create Docker hosted repository

In the Nexus web interface, create a new Docker hosted repository:

1. Go to Settings (gear icon) → Repositories → Create repository
2. Select "docker (hosted)"
3. Configure the repository with these settings:

• Name: docker-private
• HTTP port: 8082
• Enable Docker V1 API: Unchecked
• Allow anonymous docker pull: Unchecked

Create Docker proxy repository

Create a proxy repository for Docker Hub to cache images locally:

1. Create repository → docker (proxy)
2. Configure with these settings:

• Name: docker-proxy
• Remote storage: https://registry-1.docker.io
• Docker Index: Use Docker Hub
• HTTP port: 8083

Create Docker group repository

Create a group repository that combines hosted and proxy repositories:

1. Create repository → docker (group)
2. Configure with these settings:

• Name: docker-group
• HTTP port: 8084
• Member repositories: docker-private, docker-proxy

Configure Docker authentication

Create a role and user for Docker registry access:

1. Go to Settings → Security → Roles → Create role
2. Role ID: docker-user
3. Role name: Docker User
4. Privileges: nx-repository-view-docker--

Create a user:

1. Go to Settings → Security → Users → Create user
2. ID: dockeruser
3. Password: Use a strong password
4. Roles: docker-user

Create Maven hosted repository

Set up a private Maven repository for your artifacts:

1. Create repository → maven2 (hosted)
2. Configure with these settings:

• Name: maven-private
• Version policy: Mixed
• Layout policy: Strict
• Deployment policy: Allow redeploy

Create Maven proxy repository

Create a proxy for Maven Central to cache dependencies:

1. Create repository → maven2 (proxy)
2. Configure with these settings:

• Name: maven-central
• Remote storage: https://repo1.maven.org/maven2/
• Version policy: Release

Create npm hosted repository

Set up a private npm repository for Node.js packages:

1. Create repository → npm (hosted)
2. Configure with these settings:

• Name: npm-private
• Deployment policy: Allow redeploy

Create npm proxy repository

Create a proxy for the npm registry:

1. Create repository → npm (proxy)
2. Configure with these settings:

• Name: npm-proxy
• Remote storage: https://registry.npmjs.org

Create backup script

Set up automated backups of Nexus data and configuration.

#!/bin/bash

BACKUP_DIR="/opt/nexus-backups"
DATE=$(date +"%Y%m%d_%H%M%S")
BACKUP_NAME="nexus-backup-$DATE"
RETENTION_DAYS=30

Create backup directory
mkdir -p $BACKUP_DIR

Stop Nexus service
sudo systemctl stop nexus

Create backup
echo "Creating backup: $BACKUP_NAME"
tar -czf $BACKUP_DIR/$BACKUP_NAME.tar.gz \
    -C /opt sonatype-work/nexus3 \
    --exclude='sonatype-work/nexus3/log' \
    --exclude='sonatype-work/nexus3/tmp'

Start Nexus service
sudo systemctl start nexus

Remove old backups
find $BACKUP_DIR -name "nexus-backup-*.tar.gz" -mtime +$RETENTION_DAYS -delete

Log completion
echo "Backup completed: $BACKUP_DIR/$BACKUP_NAME.tar.gz"
echo "Backup size: $(du -h $BACKUP_DIR/$BACKUP_NAME.tar.gz | cut -f1)"

Optional: Upload to remote storage
aws s3 cp $BACKUP_DIR/$BACKUP_NAME.tar.gz s3://your-backup-bucket/nexus/

Make the script executable and set proper ownership:

sudo chmod 755 /opt/nexus/backup-nexus.sh
sudo chown nexus:nexus /opt/nexus/backup-nexus.sh
sudo mkdir -p /opt/nexus-backups
sudo chown nexus:nexus /opt/nexus-backups

Schedule automated backups

Set up a cron job to run daily backups at 2 AM.

sudo crontab -u nexus -e

Add the following line to the crontab:

0 2   * /opt/nexus/backup-nexus.sh >> /opt/nexus-backups/backup.log 2>&1

Configure log rotation

Set up log rotation to prevent log files from consuming excessive disk space.

/opt/sonatype-work/nexus3/log/*.log {
    daily
    missingok
    rotate 30
    compress
    delaycompress
    notifempty
    copytruncate
    su nexus nexus
}

Set up basic monitoring

Create a simple health check script to monitor Nexus availability.

#!/bin/bash

NEXUS_URL="https://nexus.example.com/service/rest/v1/status"
TIMEOUT=10
LOGFILE="/var/log/nexus-health.log"

Check if Nexus is responding
if curl -f -s --connect-timeout $TIMEOUT $NEXUS_URL > /dev/null; then
    echo "$(date): Nexus is healthy" >> $LOGFILE
    exit 0
else
    echo "$(date): Nexus health check failed" >> $LOGFILE
    # Optional: Send alert email or notification
    # echo "Nexus health check failed" | mail -s "Nexus Alert" admin@example.com
    exit 1
fi

Make the script executable and schedule it:

sudo chmod 755 /opt/nexus/health-check.sh
sudo crontab -e

Add health check to run every 5 minutes:

/5    * /opt/nexus/health-check.sh