Nexus Repository

Videos

Overview: Nexus Repository on Azure: overview (watch on YouTube)

Launch and log in: Nexus Repository on Azure: launch and log in (watch on YouTube)

Deep Dive: Nexus Repository on Azure: deep dive (watch on YouTube)

Prerequisites

Before you deploy, make sure you have an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a sensible starting point, because Nexus is a JVM application with a 2.7 GiB default heap. Size up for larger repositories or busier proxy traffic.

In the NSG, allow inbound 22/tcp from your management network and 80/tcp. Nexus serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Sonatype Nexus Repository by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:nexus-repository-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name nexus \
  --image sac1647283583153:nexus-repository-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name nexus --port 80 --priority 1010

First boot takes a few minutes. On its first boot, the VM finishes its per-VM setup in the background by generating this VM's own credentials and starting the services. If you connect as soon as the VM shows as running, wait for that setup to complete before you continue:

bash sudo cloud-init status --wait

The command prints status: done when the VM is ready. The credentials and services described below are present only after that.

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active nexus.service nginx.service

Both units report active. On a fresh VM, the Nexus first-boot service does a one-time clean initialization of the embedded database and default repositories, then rotates the admin password. This takes a couple of minutes on the very first boot, before the console is reachable.

Step 5 - Retrieve the per-VM admin password

A unique administrator password is generated on the first boot of each VM and written to a root-only file. Read it over SSH:

sudo cat /root/nexus-credentials.txt

The file contains NEXUS_URL, NEXUS_ADMIN_USER (which is admin) and NEXUS_ADMIN_PASSWORD. Keep this password safe. It is the initial administrator credential for this VM.

Use the VM's public IP address in your browser. On a VM with a Standard SKU public IP (the default, and what Step 2 creates), NEXUS_URL in this file shows the VM's private address, because the first-boot service cannot read a Standard public IP from the instance metadata. Browse to the public IP shown in the Azure portal, or get it with az vm show --show-details --query publicIps -o tsv.

Step 6 - Sign in to the Nexus web console

Browse to http://<vm-public-ip>/ and choose Sign in in the top-right corner. Sign in as admin with the password from Step 5.

After you sign in, the Browse view lists the repositories that ship ready to use, including maven-central (a proxy of Maven Central), maven-releases and maven-snapshots (hosted), maven-public (a group), and the equivalent NuGet repositories.

Step 7 - Administer and create repositories

Open the Server administration and configuration (gear) menu, then Repository > Repositories, to manage existing repositories or create new ones. Choose Create repository, then pick a recipe such as npm (hosted), docker (hosted), pypi (proxy) or raw (hosted) to add a new format.

The Support > Status view under administration shows a live health summary of the node, including available CPUs, blob store quotas and file descriptor limits.

Step 8 - Point a Maven build at your repository

Configure Maven to resolve dependencies through the maven-public group on your VM by adding a mirror to ~/.m2/settings.xml on your build machine. Replace <vm-public-ip> with your VM address.

Anonymous access is disabled on this image, so an unauthenticated request to maven-public returns 401. The <servers> entry, whose <id> matches the mirror's, gives Maven the credentials. Use the admin account from Step 5 or, better, a dedicated user you create under Security > Users:

<settings> <servers> <server> <id>sac-nexus</id> <username>admin</username> <password>NEXUS_ADMIN_PASSWORD from Step 5</password> </server> </servers> <mirrors> <mirror> <id>sac-nexus</id> <name>sac Nexus</name> <url>http://<vm-public-ip>/repository/maven-public/</url> <mirrorOf>*</mirrorOf> </mirror> </mirrors> </settings>

To publish build outputs, deploy to the maven-releases or maven-snapshots hosted repositories at http://<vm-public-ip>/repository/maven-releases/ using your admin credentials (or a dedicated deployment user you create under Security > Users).

Step 9 - Verify the REST API and health endpoint

nginx serves an unauthenticated health endpoint that Azure Load Balancer probes can target, and Nexus exposes a status endpoint. Query both:

curl -s http://127.0.0.1/health
curl -s http://127.0.0.1/service/rest/v1/status -o /dev/null -w 'status endpoint HTTP %{http_code}\n'

The write-availability endpoint also answers without credentials, but credentials sent with it are checked, and a wrong password returns 401. The following command reads the per-VM password from the credentials file, so no password appears on your command line. It confirms that the per-VM password authenticates and that the instance is writable, and returns 200:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/service/rest/v1/status/writable -o /dev/null -w 'writable HTTP %{http_code}\n'

For reference, the equivalent authenticated call from a remote machine is curl -u admin:<NEXUS_ADMIN_PASSWORD> http://<vm-public-ip>/service/rest/v1/status/writable, substituting the password from Step 5. A wrong password returns 401.

Step 10 - Maintenance

systemd manages Nexus and its reverse proxy. Restart or inspect them with:

sudo systemctl restart nexus.service
sudo journalctl -u nexus.service --no-pager | tail -n 20

All repository data, the embedded database and the search index live under /var/lib/nexus on the dedicated data disk, so they survive OS patching and can be resized independently. The application log is at /var/lib/nexus/log/nexus.log.

Anonymous access is disabled by default. To allow unauthenticated read of public repositories, enable it under Security > Anonymous Access. Because Nexus serves plain HTTP on port 80, place it behind TLS with your own domain before you run it in production.

Support

SecureAnyCloud maintains this image and provides 24/7 support. For help, contact sales@secureanycloud.com.

Deploy on Azure

Launch Sonatype Nexus Repository OSS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH on port 22 using the key pair you selected at launch. The login user depends on the operating system variant you launched:

OS variant SSH login user Example

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<public-ip>

Replace <public-ip> with your instance's public IPv4 address, and your-key.pem with the private key file for the key pair you chose at launch.

Retrieving your administrator password

Nothing in this image ships with a usable login. On the first boot of each instance, a one-shot service waits for Nexus to initialize. It replaces the bootstrap password that Nexus generates with a random per-instance password, disables anonymous access, verifies that the new password authenticates, and writes the password to a root-only file.

First, confirm that first boot has finished and both services are running:

sudo systemctl is-active nexus.service nginx.service

Confirm the first-boot service completed and left its sentinel:

ls -l /var/lib/sac/data/nexus-repository-firstboot.done

Only root can read the credentials file. Check which fields it holds. This command prints the field names only, never their values:

sudo grep -oE '^[A-Z_]+=' /root/nexus-credentials.txt

To read the password itself, print just that one field:

Purpose Command

Show the administrator password sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt \| cut -d= -f2-

Show the whole credentials file sudo cat /root/nexus-credentials.txt

The username is admin. Treat this password as you would any production administrator credential, and change it from My Account > Change password after you sign in.

Checking the service is healthy

nginx serves an unauthenticated health endpoint. It returns 200 as soon as the reverse proxy is serving, which makes it a ready-made health check for an Application Load Balancer target group:

curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/health

Nexus itself answers its status endpoint on the loopback interface:

curl -s -o /dev/null -w 'nexus status: HTTP %{http_code}\n' http://127.0.0.1/service/rest/v1/status

Confirm Nexus is listening on loopback only. Nexus is never published directly, and nginx is the only front door:

sudo ss -tln | grep 8081

Confirm the JVM in use is the distribution's OpenJDK 21, not a bundled runtime:

java -version 2>&1 | head -1

Nexus is a JVM application, so a cold start takes a couple of minutes while it initializes. If the status endpoint is not answering yet, watch it come up:

sudo journalctl -u nexus.service --no-pager | tail -5

Signing in

Open http://<public-ip>/ in a browser and sign in as admin with the password from the credentials file. Work through the onboarding wizard, and accept Sonatype's license agreement when prompted.

Anonymous access is disabled by default, so a freshly launched instance is never open to the internet. To allow unauthenticated read access to your public proxy repositories, enable it under Settings > Security > Anonymous Access.

The preconfigured repositories

Nexus initializes with a working set of Maven and NuGet repositories. Browse them under Browse in the left-hand navigation, where each row shows its type, format, online status and a copyable repository URL:

You can list the same set from the command line. This command reads the administrator password into a shell variable so it is never printed:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/service/rest/v1/repositories | jq -r '.[] | "\(.name)\t\(.type)\t\(.format)"'

The three repository types are the whole model:

• proxy caches a remote registry such as Maven Central or npmjs.org. Your builds pull from Nexus, and Nexus fetches and caches from upstream once.
• hosted stores artifacts you publish yourself, such as in-house jars or private npm packages.
• group presents several repositories behind one URL, so a build tool needs only a single entry.

Creating a repository

Create new repositories under Settings > Repository > Repositories > Create repository, where you pick a format and a type:

To add an npm proxy of the public registry from the command line:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'create npm-proxy: HTTP %{http_code}\n' -u "admin:$PW" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"name":"npm-proxy","online":true,"storage":{"blobStoreName":"default","strictContentTypeValidation":true},"proxy":{"remoteUrl":"https://registry.npmjs.org","contentMaxAge":1440,"metadataMaxAge":1440},"negativeCache":{"enabled":true,"timeToLive":1440},"httpClient":{"blocked":false,"autoBlock":true}}' \
  http://127.0.0.1/service/rest/v1/repositories/npm/proxy

A 201 means it was created. Confirm it is online:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/service/rest/v1/repositories | jq -r '.[] | select(.name=="npm-proxy") | "\(.name)\t\(.format)\t\(.type)\t\(.url)"'

Pointing your build tools at Nexus

Replace <public-ip> with your instance address (or your DNS name once you have attached one) in the examples below.

Maven: add a mirror to ~/.m2/settings.xml on your build machines so every dependency resolves through the maven-public group:

<settings> <mirrors> <mirror> <id>nexus</id> <name>sac Nexus Repository</name> <url>http://<public-ip>/repository/maven-public/</url> <mirrorOf>*</mirrorOf> </mirror> </mirrors> </settings>

npm: point the client at the npm proxy you created above:

Task Command (run on your build machine)

Set the registry npm config set registry http://<public-ip>/repository/npm-proxy/

Authenticate npm login --registry http://<public-ip>/repository/npm-proxy/

Docker: Docker registry connectors listen on their own ports. Add a repository with a connector port under Settings > Repository > Repositories, then open that port in the instance's security group before you push or pull.

Storage and the data volume

Every blob store, the embedded database, the search index and the logs live on the dedicated data volume, separate from the operating system disk. Check its usage:

df -h /var/lib/nexus | tail -1

The volume is mounted by filesystem UUID so it survives reboots and instance replacement:

grep nexus /etc/fstab

An artifact repository grows steadily. To enlarge the volume, modify the EBS volume in the AWS console (or with aws ec2 modify-volume), then grow the filesystem in place, with no downtime and no reinstall:

Step Command

Grow the filesystem after enlarging the EBS volume sudo resize2fs $(findmnt -no SOURCE /var/lib/nexus)

Confirm the new size df -h /var/lib/nexus

To keep storage in check, configure Settings > Repository > Cleanup Policies to remove snapshots and unused components on a schedule, and enable the Compact blob store task under Settings > System > Tasks.

Securing your instance

The image is secure by default: no security database and no bootstrap password ship in it, each instance mints its own administrator password, and anonymous access is off. A few steps are still yours:

• Restrict the security group. Port 80 is open so you can reach the UI. Narrow it to your office or VPC CIDR, and keep port 22 restricted to trusted addresses.
• Terminate TLS. Attach a DNS name, and either put an AWS Application Load Balancer with an ACM certificate in front of the instance or install Let's Encrypt on the instance itself. Serve credentials and artifacts over HTTPS only.
• Create per-team users and roles under Settings > Security, rather than sharing the admin account. Nexus supports fine-grained privileges per repository.
• Encrypt data at rest by enabling EBS encryption on the data volume.

Backing up

Nexus state is entirely within the data volume, so an EBS snapshot of it is a complete backup. Take snapshots on a schedule with AWS Backup or Data Lifecycle Manager.

For a consistent snapshot, stop Nexus first so the embedded database is not mid-write:

Step Command

Stop Nexus before snapshotting sudo systemctl stop nexus.service

Start it again afterwards sudo systemctl start nexus.service

Nexus also ships a Backup task under Settings > System > Tasks. It exports the databases to a directory you choose while the service keeps running, which makes it useful for a logical backup alongside the volume snapshots.

Troubleshooting

Symptom What to check

The UI does not load Nexus is a JVM application and a cold start takes a couple of minutes. Check sudo systemctl status nexus.service and sudo journalctl -u nexus.service.

502 Bad Gateway from nginx Nexus is not yet listening on 8081. Wait for the cold start, then re-check with the status endpoint above.

Cannot fetch or upload components The onboarding wizard's licence agreement has not been accepted yet. Sign in as admin and complete it.

New components stop being added You have reached a Community Edition usage threshold. Check the Usage Center panel on the Dashboard.

Out of disk space Grow the data volume as shown above, and configure cleanup policies plus the compact blob store task.

Forgotten administrator password The per-instance password is in /root/nexus-credentials.txt, readable by root only.

Useful log locations:

sudo tail -5 /var/lib/nexus/log/nexus.log

Support

SecureAnyCloud provides 24/7 technical support for this product with a guaranteed 24-hour response SLA. Contact sales@secureanycloud.com for help with deployment, repository and build tool configuration, TLS, storage sizing, upgrades or troubleshooting.

Deploy on AWS

Launch Sonatype Nexus Repository with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com