Deployment guide

Apache Archiva

Overview

Apache Archiva is a repository manager for the binary artifacts that your builds produce and consume. It stores and serves Maven (and other) repositories, and it can proxy and cache remote repositories such as Maven Central. Your CI fleet then pulls dependencies from a single fast local mirror.

The SecureAnyCloud image installs Apache Archiva 2.2.10 as a self-contained standalone distribution. A bundled Jetty servlet container serves the Archiva web application, and an embedded Apache Derby database holds the redback security store (users and roles) and the Archiva configuration. Archiva runs as a dedicated archiva service account, bound to the loopback connector behind an nginx reverse proxy on port 80. The image keeps all repository storage, the security database and the search indexes on a dedicated Azure data disk, and it generates a unique admin password on the first boot of every VM. The image is backed by 24/7 SecureAnyCloud support.

What you get:

Apache Archiva 2.2.10 (standalone distribution, bundled Jetty) on OpenJDK 8
The Archiva web console for browsing, searching, uploading and administering repositories
nginx on :80 as a reverse proxy to the loopback Archiva connector on 127.0.0.1:8080
A per-VM admin account generated on first boot and recorded in a root-only file
A dedicated Azure data disk at /var/lib/archiva for repository storage, the redback/Derby security database and the search indexes
archiva.service (running as the unprivileged archiva user) and nginx.service as systemd units, enabled and active
An unauthenticated /health endpoint for Azure Load Balancer health probes
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a reasonable starting point. Choose a larger size for larger repositories or busier proxy traffic.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp. Archiva serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Archiva by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-archiva-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name archiva \
  --image sac1647283583153:apache-archiva-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name archiva --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active archiva.service nginx.service

Both services report active. Archiva runs as the dedicated archiva user and listens on the loopback connector 127.0.0.1:8080. nginx fronts it on port 80. All repository storage, the redback/Derby security database and the search indexes live on the dedicated Azure data disk mounted at /var/lib/archiva.

Step 5 - Retrieve your admin password

The first boot of your VM generates a unique Archiva admin password and writes it to a root-only file. Read the file:

sudo cat /root/archiva-credentials.txt

This file contains ARCHIVA_ADMIN_USER (admin) and ARCHIVA_ADMIN_PASSWORD, along with the Archiva URL. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok. This endpoint never requires authentication, so you can safely use it for an Azure Load Balancer health probe.

Step 7 - Sign in to the Archiva web console

Browse to http://<vm-public-ip>/ and choose Login in the top-right corner. Sign in as admin with the password from Step 5.

After you sign in, use the Browse view (under Artifacts) to walk the group, artifact and version hierarchy of your managed repositories.

Use the Search view to find artifacts by coordinates or class name across every repository Archiva manages.

Under Administration -> Repositories, manage the bundled managed repositories (internal, snapshots) and add proxy connectors to remote repositories such as Maven Central.

Step 8 - Verify admin authentication from the command line

Archiva's redback REST API rejects a wrong password and returns the admin user record for the per-VM password. Read the password from the credentials file first, then call the login service. Because the command embeds your unique password, run it interactively rather than from a script. Substitute the value of ARCHIVA_ADMIN_PASSWORD from Step 5 for <ARCHIVA_ADMIN_PASSWORD>:

RB=http://127.0.0.1:8080/restServices/redbackServices; curl -s -X POST -H 'Content-Type: application/json' --data '{"username":"admin","password":"<ARCHIVA_ADMIN_PASSWORD>"}' $RB/loginService/logIn

The response is a JSON object beginning {"username":"admin",...}. A wrong password returns an error body with no username field.

Step 9 - Point Maven at your Archiva repositories

Archiva exposes each managed repository under http://<vm-public-ip>/repository/<id>/. To resolve dependencies through Archiva's proxy of Maven Central, add a mirror to your ~/.m2/settings.xml:

<settings> <mirrors> <mirror> <id>archiva-internal</id> <name>sac Archiva</name> <url>http://<vm-public-ip>/repository/internal/</url> <mirrorOf>*</mirrorOf> </mirror> </mirrors> </settings>

To deploy your own compiled outputs, add distributionManagement pointing at the internal (releases) and snapshots repositories, and a matching <server> credential entry in settings.xml using the admin account (or a dedicated deployment user you create under Administration -> Users).

Step 10 - Confirm repository data lives on the dedicated disk

Archiva's appserver.base holds the managed repositories, the redback/Derby security database, the search indexes, the configuration and the logs. It is stored on the dedicated Azure data disk, so it survives OS changes and you can resize it independently:

findmnt /var/lib/archiva

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Maintenance

Users and roles: add or rotate accounts under Administration -> Users in the web console, or via the redback REST API.
Repositories: create managed repositories and proxy connectors under Administration -> Repositories and Proxy Connectors.
Storage: managed repositories, the Derby security database and the search indexes live under /var/lib/archiva on the data disk; back up that volume to protect your artifacts and configuration.
Logs: Archiva logs are under /var/lib/archiva/logs on the data disk.
Tuning: edit the JVM heap (-Xms / -Xmx) in the archiva.service unit (/etc/systemd/system/archiva.service), then sudo systemctl daemon-reload && sudo systemctl restart archiva.
TLS: Archiva serves plain HTTP on port 80; front it with TLS (for example, certbot) and your own domain before running it in production.
Security patches: unattended-upgrades stays enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Apache Archiva on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Apache Archiva is the open source repository manager for the binary artifacts that your builds produce and consume. It gives your teams a central, governed store. Archiva manages Maven, Gradle and Ivy repositories for your own releases and snapshots, and remote proxy connectors that cache dependencies from Maven Central and other upstreams. Your teams then resolve dependencies from one location instead of reaching the public internet on every build.

This image runs Archiva as a self-contained standalone distribution. A bundled Jetty servlet container serves the Archiva web application, and an embedded Apache Derby database holds the security store (users and roles) and the Archiva configuration. Archiva runs on OpenJDK 8, the version Archiva 2.2.x requires, and nginx fronts it as a reverse proxy. Jetty binds 127.0.0.1:8080 and is reached through nginx on port 80 (and 443 once you add TLS).

The repository storage, security database and search index live on a dedicated EBS data volume mounted at /var/lib/archiva. You can resize the volume independently of the operating system disk.

On the first boot of every deployed instance, a one-shot service creates a single administrator account with a per-instance password through the Archiva security API, verifies it, and writes the login to /root/archiva-credentials.txt with mode 0600. No shared or default credentials ship in the image.

Prerequisites

To deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks your developers and build agents will reach Archiva on
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Apache Archiva. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group. The group must allow inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger. The image adds a separate data volume for the repository store automatically.

Select Launch instance. First boot initialisation takes under a minute after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud Apache Archiva Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=archiva-01}]'

The command prints a JSON document on success. Note the instance ID, then retrieve its public address once it is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve the Administrator Login

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched. For Apache Archiva 2.2 on Ubuntu 24.04, the SSH login user is ubuntu.

The first boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/archiva-credentials.txt

The command prints a plain text file containing the Archiva URL, the administrator username admin and the password. From the same SSH session, confirm that the deployment is healthy. nginx serves the health endpoint, and it is open:

curl -fsS http://127.0.0.1/health

ok

An ok response confirms that nginx is fronting the application. You can also confirm that the Archiva application and its security store are answering behind the proxy. This endpoint returns true once the per-instance administrator has been provisioned:

curl -fsS -H "Referer: http://127.0.0.1:8080/" http://127.0.0.1:8080/restServices/redbackServices/userService/isAdminUserExists

true

A true response confirms that the full stack (nginx, Jetty and the Archiva security store) is serving and that the administrator account seeded on first boot is present.

First Sign-in

Open a web browser and go to http://<public-ip>/. Archiva presents its welcome page with Login and Register in the top right.

The Apache Archiva welcome page, served on first boot behind nginx.

Select Login, enter the username admin and the password from /root/archiva-credentials.txt, then select Ok. After you sign in, the full administration menu appears in the left navigation.

Signed in as the per-instance administrator, with the Artifacts, Administration and Users menus.

Review the Managed Repositories

Select Repositories under Administration. Archiva ships with two managed Maven 2.x repositories, internal for releases and snapshots for snapshot builds, and a central remote repository that proxies Maven Central. The Managed Repositories Management and Remote Repositories Management tabs let you add, edit and remove repositories.

Repositories Administration, showing the default managed release and snapshot repositories.

Point Maven at the Repository

To resolve dependencies through Archiva's proxy and to deploy your own artifacts, point your build at the repository. Add the repository as a mirror in your Maven settings.xml, so that all dependency resolution flows through Archiva:

<settings> <mirrors> <mirror> <id>archiva-internal</id> <url>http://your-archiva-host/repository/internal/</url> <mirrorOf>*</mirrorOf> </mirror> </mirrors> </settings>

To deploy a build to the internal and snapshots repositories, add matching <distributionManagement> entries to your project POM pointing at http://your-archiva-host/repository/internal/ and .../snapshots/, and a <server> entry in settings.xml with your Archiva username and password. Gradle and Ivy consume the same repository URLs. Browse deployed artifacts and their POM metadata under Browse, and search the index with the Search box.

Administer Users and Roles

Open Manage under Users to review and create accounts. The image ships the single per-instance admin account created on first boot, plus the built-in read-only guest. Add developer and deployer accounts here, and assign per-repository roles under Roles so each team can read, deploy to, or manage only the repositories they should.

Users List, showing the per-instance administrator seeded on first boot, ready for you to add your team.

Every action in the web application is also available through the Archiva REST API under http://<public-ip>/restServices/. Use it to script repository creation and user management.

Enable HTTPS with Let's Encrypt

For any production deployment, serve Archiva over HTTPS so that logins and artifact transfers cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The following steps assume that you have a DNS record pointing your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d archiva.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

certbot obtains a certificate and rewrites the nginx server block to serve HTTPS and redirect HTTP. Renewal is handled automatically by the certbot systemd timer.

Backups and Maintenance

Archiva keeps the embedded security database, the managed repositories and the search index under /var/lib/archiva on the dedicated data volume. Because that is a separate EBS volume, you can take a coordinated EBS snapshot of it for point-in-time backups, or archive the tree to object storage:

sudo systemctl stop archiva
sudo tar czf <backup-dir>/archiva-$(date +%F).tgz -C /var/lib archiva
sudo systemctl start archiva

Ship the archive to an Amazon S3 bucket or another object store. To upgrade Archiva, follow the official upgrade notes and replace the distribution under /opt/archiva, keeping the data volume in place. The services run under systemd. Check their state at any time:

systemctl is-active archiva nginx

active active

Scaling and Operations

Put the web tier behind an Application Load Balancer and terminate TLS there for high availability
Add remote proxy connectors for additional upstreams (Gradle Plugin Portal, JCenter mirrors, in-house Nexus) under Proxy Connectors
Grow the repository store by extending the EBS data volume and running sudo resize2fs on /var/lib/archiva
Schedule Repository Scanning to keep the search index current after bulk deploys

Each of these is documented in the official Apache Archiva documentation at https://archiva.apache.org/docs/2.2.10/.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Guaranteed response within 24 hours, one hour average for critical issues. Contact sales@secureanycloud.com.

For general Apache Archiva questions, consult the documentation at https://archiva.apache.org/. Apache Archiva is a trademark of the Apache Software Foundation. The name is used here nominatively and does not imply affiliation or endorsement.

Deploy on AWS

Launch Apache Archiva on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS