Deployment guide

Reposilite

Overview

Reposilite is a lightweight, self-hosted Maven repository manager for the JVM ecosystem. It hosts your private Maven and Gradle artifacts, proxies and caches upstream repositories, and controls access with simple access tokens. It does all this as a single Java application, without the operational weight of a full artifact server.

This SecureAnyCloud image installs Reposilite 3.5.28 on a Temurin 21 JRE and runs it as a systemd service behind an nginx reverse proxy on port 80. Every VM generates its own manager access token on first boot.

What you get:

Reposilite 3.5.28 running on an Eclipse Temurin 21 JRE
The web dashboard and Maven/Gradle registry published on port 80 through nginx, with WebSocket upgrade and a 1 GiB body limit for large artifact deploys
Default releases, snapshots and private repositories, ready to use
A dedicated Azure data disk at /var/lib/reposilite for the repository tree, the configuration and the access-token database
A unique manager access token generated on first boot and written to a root-only credentials file
reposilite.service and nginx.service as enabled, active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a good starting size.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the registry and dashboard. For public exposure, put TLS in front of the registry (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Reposilite by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:reposilite-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name reposilite \
  --image sac1647283583153:reposilite-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name reposilite --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active.

systemctl is-active reposilite.service nginx.service

Both report active. On first boot, Reposilite generates a unique manager access token and stores it in the access-token database on the data disk.

Step 5 - Retrieve your admin access token

Your VM generates a unique manager access token on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/reposilite-credentials.txt

The file contains reposilite.admin.name (admin) and reposilite.admin.token. Store the token somewhere safe, because it grants full management access.

Step 6 - Check the health endpoint

The Reposilite dashboard returns 200 without authentication, and nginx also serves a static health endpoint:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/health

Step 7 - Open the web dashboard

Browse to http://<vm-public-ip>/. The dashboard shows your repository index. The Repository details panel offers ready-to-copy Maven, Gradle Kotlin, Gradle Groovy and SBT snippets for consuming artifacts.

Click a repository, for example releases, to browse its artifact tree. A freshly deployed image starts empty.

Select Sign in in the top right and authenticate with your access token: the name admin and the token from Step 5.

Once you are signed in as a manager, the Dashboard, Console and Settings tabs let you manage repositories, tokens and shared configuration.

Step 8 - Confirm your access token authenticates

Reposilite exposes GET /api/auth/me for verifying credentials. Pass the token as HTTP Basic auth. A valid token returns 200, and a missing or wrong token returns 401.

curl -s -o /dev/null -w '%{http_code}\n' -u 'admin:<REPOSILITE_ADMIN_TOKEN>' http://localhost/api/auth/me

Step 9 - Configure Maven to publish and consume artifacts

On a developer machine, add a server entry to ~/.m2/settings.xml. Use your token name as the username and the token value as the password.

<settings> <servers> <server> <id>reposilite-releases</id> <username>admin</username> <password><REPOSILITE_ADMIN_TOKEN></password> </server> <server> <id>reposilite-snapshots</id> <username>admin</username> <password><REPOSILITE_ADMIN_TOKEN></password> </server> </servers> </settings>

Then point your project's pom.xml at the repositories, matching the <id> values above.

<distributionManagement> <repository> <id>reposilite-releases</id> <url>http://<vm-public-ip>/releases</url> </repository> <snapshotRepository> <id>reposilite-snapshots</id> <url>http://<vm-public-ip>/snapshots</url> </snapshotRepository> </distributionManagement>

Deploy an artifact with mvn deploy. To consume artifacts, add a matching <repository> block under <repositories> in your pom.xml.

Step 10 - Configure Gradle to publish and consume artifacts

In your Gradle build (Kotlin DSL), declare the repository with your token credentials:

publishing { repositories { maven { url = uri("http://<vm-public-ip>/releases") credentials { username = "admin" password = "<REPOSILITE_ADMIN_TOKEN>" } isAllowInsecureProtocol = true } } }

Run gradle publish to deploy. To resolve dependencies from Reposilite, add the same maven { ... } block under repositories { } in your build script.

Step 11 - Confirm storage lives on the dedicated disk

The repository tree, configuration and access-token database are stored on the dedicated Azure data disk, so they survive OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/reposilite

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Enabling HTTPS

The nginx reverse proxy serves plain HTTP on port 80. For public exposure, put a certificate in front of it. Add a DNS name for the VM and install certbot, or use the companion SecureAnyCloud nginx-ssl-certbot image as a TLS reverse proxy.

Keep Reposilite bound to loopback (127.0.0.1:8080), so the only public surface is the TLS-terminated proxy. Once you serve over HTTPS, you can drop isAllowInsecureProtocol from the Gradle config above.

Maintenance

Backups: snapshot the /var/lib/reposilite data disk to back up the repository tree, the configuration and the access-token database.
Tokens: manage access tokens from the Console tab in the dashboard, or with the token-generate <name> <permissions> and token-list console commands. Use the m permission for managers.
Service: run sudo systemctl restart reposilite after configuration changes. View logs with journalctl -u reposilite.
Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Reposilite on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Reposilite is a lightweight, high-performance, open source repository manager for Maven and Gradle artifacts, written in Kotlin on the JVM. It hosts your private Maven repositories and proxies and caches remote repositories such as Maven Central. It also provides a modern web dashboard, a REST API and access token authentication, all from a single self-contained service.

This SecureAnyCloud image runs Reposilite from its official standalone JAR on a private Eclipse Temurin 21 JRE. A systemd service starts it on boot and restarts it on failure. The administrative manager token is generated on the first boot of every deployed instance, so no two instances launched from the same Amazon Machine Image share a token.

What you get:

Reposilite running as the dedicated, unprivileged reposilite system account under systemd
A working directory at /var/lib/reposilite on a dedicated, independently resizable EBS data volume, holding the configuration, the SQLite token and statistics database, and the hosted artifacts
Reposilite's own access token authentication, with the JAR bound to the loopback interface only and never exposed directly
An nginx reverse proxy that publishes the web dashboard, the Maven and Gradle repositories and the REST API on port 80, with WebSocket support for the live management console
A manager token written to /root/reposilite-aws-credentials.txt with mode 0600, so only the root user can read it

Prerequisites

Before you deploy, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the dashboard, repositories and REST API
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Reposilite. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that opens port 22 from your management network and port 80 for the dashboard and repositories. Leave the root volume at the default size or larger.

Select Launch instance. After the instance state becomes Running and the status checks pass, first-boot initialization takes up to a minute. It generates the admin manager token and starts Reposilite.

Launch the Instance from the AWS CLI

Run the following command to launch an instance from the SecureAnyCloud Reposilite Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22 and 80, as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=reposilite}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Admin Manager Token

Your instance generated a unique Reposilite admin token on first boot. Read it as root:

sudo cat /root/reposilite-aws-credentials.txt

The file lists the dashboard URL, the token name (admin), the generated token secret, and example REST and Maven usage.

The admin token is a manager token, so it has full administrative access. Keep it somewhere safe.

Sign In to the Web Dashboard

nginx serves the Reposilite web dashboard on port 80. In a browser, go to:

http://<instance-public-ip>/

Select Sign in in the top right, then enter the token name admin and the generated token secret. After you sign in, the management tabs (Overview, Dashboard, Console and Settings) and the hosted repositories appear.

The Overview tab browses the hosted repositories. Reposilite ships with a releases, a snapshots and a private repository by default. Open a repository to browse its group, artifact and version tree.

On the Settings tab, a manager can configure authentication, the frontend, Maven behavior, statistics and the web server. Changes are applied through the live console.

Confirm Reposilite Is Running

Over SSH, confirm that Reposilite and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active reposilite nginx
sudo ss -tlnp | grep -E ':(80|8080) '

Both services report active. Reposilite listens on 127.0.0.1:8080 (loopback only), and nginx listens on port 80.

Verify the Token with the REST API

Reposilite exposes a REST API on port 80 behind the same access token authentication. Use the auth/me endpoint to verify your manager token and inspect its permissions. On the instance, read the token from the credentials file and call the API over loopback:

TOKEN=$(sudo grep '^reposilite.admin.token=' /root/reposilite-aws-credentials.txt | cut -d= -f2-)
curl -s -u "admin:${TOKEN}" http://127.0.0.1/api/auth/me

The response is a JSON document that lists the token name, its manager permission and any per-route permissions.

From outside the instance, send the same request to http://<instance-public-ip>/api/auth/me with HTTP Basic user admin and your token.

Publish and Resolve an Artifact

Reposilite serves the standard Maven layout, so you can publish and resolve artifacts over plain HTTP. Run the following loopback example on the instance. It publishes a small file into the default releases repository and resolves it again, which confirms that the repository is live.

TOKEN=$(sudo grep '^reposilite.admin.token=' /root/reposilite-aws-credentials.txt | cut -d= -f2-) printf 'hello from reposilite\n' > /tmp/example.txt curl -s -u "admin:${TOKEN}" --upload-file /tmp/example.txt \
  http://127.0.0.1/releases/com/example/demo/1.0.0/demo-1.0.0.txt curl -s -u "admin:${TOKEN}" \
  http://127.0.0.1/releases/com/example/demo/1.0.0/demo-1.0.0.txt

The upload returns the deployed path, and the download returns the file contents. From your build machines, target http://<instance-public-ip>/releases/... with the same token.

Configure Maven

To resolve and deploy artifacts from Maven, add a <server> entry to your ~/.m2/settings.xml. Use the token name as the username and the token secret as the password. Then reference the repository in your project.

The dashboard Repository details panel generates the exact snippets for Maven, Gradle Kotlin, Gradle Groovy and SBT. A typical settings.xml server entry looks like this, with <your-token> replaced by the token secret:

<settings> <servers> <server> <id>reposilite-releases</id> <username>admin</username> <password><your-token></password> </server> </servers> </settings>

In your project pom.xml, point the repository and distribution management at http://<instance-public-ip>/releases, using the matching <id>.

For day-to-day use, issue a dedicated read or read-and-write token to each developer or CI pipeline from the dashboard Console tab. Do not share the admin manager token.

Issue Access Tokens for Your Team

The admin manager token is for administration. Create scoped tokens for your developers and CI from the dashboard Console tab, which drives the same remote command line as the server console.

Use the token-generate command with a name and a permission shortcut: r for read or w for write. You can also restrict the token to a route. Reposilite returns the generated secret only once, so record it immediately.

Manager (m) tokens have full access and should be reserved for administrators.

Proxy Remote Repositories

Reposilite can proxy and cache remote repositories such as Maven Central, so your builds pull through a single endpoint. In the Settings tab, edit the Maven configuration to add proxied hosts to a repository. Then point your build tools at your Reposilite repository instead of the upstream.

Cached artifacts are stored under the working directory on the data volume.

The Data Volume

The Reposilite working directory lives on a dedicated EBS volume mounted at /var/lib/reposilite. This keeps the configuration, the token database and the hosted artifacts off the operating system disk and lets you resize or snapshot the volume independently. Confirm the mount:

df -h /var/lib/reposilite

To grow the store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance by running sudo resize2fs on the underlying device.

Enable HTTPS

nginx serves the dashboard, repositories and REST API over plain HTTP on port 80. For production use, place them behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:8080, exactly as the bundled site does for port 80. Keep the WebSocket upgrade headers in place.

Restrict the security group so that ports 80 and 443 are reachable only from the networks that publish and resolve artifacts.

Backup and Maintenance

Back up Reposilite by snapshotting the /var/lib/reposilite EBS volume. The snapshot captures the configuration, the token database and every hosted artifact.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Reposilite and nginx start automatically on boot.

Support

SecureAnyCloud publishes and supports this image. Support covers deployment, repository and proxy configuration, access token and permission management, Maven and Gradle client setup, and storage and TLS tuning.

Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Reposilite on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS