Sonatype Nexus Repository on AWS User Guide

Overview

This guide covers the deployment and configuration of Sonatype Nexus Repository on AWS using cloudimg AWS Marketplace AMIs. Nexus Repository is the universal artifact repository manager: a single self-hosted service that proxies, caches, hosts and groups packages across Maven, npm, Docker, NuGet, PyPI, RubyGems, Go, Helm, APT, YUM and raw formats.

Point your builds at it once and every dependency your teams pull is cached locally — surviving upstream outages and cutting both build times and egress — while every internal artifact your pipelines publish has a governed home inside your own AWS account.

The cloudimg image ships the upstream release unmodified. Nexus runs as an unprivileged service account under systemd on the distribution's own patched OpenJDK 21, bound to the loopback interface, with nginx published on port 80 in front of it. The complete data directory — every blob store, the embedded configuration and security database, the search index and the logs — lives on a dedicated EBS volume you can resize independently of the operating system disk. Backed by 24/7 cloudimg support.

Sonatype and Nexus Repository are trademarks of their respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by Sonatype. It ships the upstream self-hosted software, unmodified.

What is included:

• Sonatype Nexus Repository 3.94.1-06, the current upstream release
• OpenJDK 21 (JRE headless) from the Ubuntu archive — the runtime is patched by the distribution, and the JRE bundled in the upstream archive is removed from the image
• nginx reverse proxy on port 80, tuned for large artifact uploads, serving an unauthenticated /health endpoint for load balancer target groups
• A dedicated 100 GiB gp3 data volume mounted at /var/lib/nexus, mounted by filesystem UUID and captured into the AMI
• A first-boot service that generates a unique administrator password per instance and disables anonymous access

Editions and licensing

This image ships the free tier of Nexus Repository. No Sonatype commercial licence is installed and no Sonatype Professional capability is included.

Sonatype's open source core is licensed under the Eclipse Public License 1.0. The free tier is distributed as Community Edition, which applies usage thresholds published by Sonatype — currently 40,000 total components and 100,000 requests per day. Above those thresholds the addition of new components pauses until usage falls back below them. You can watch your current position against both limits on the Dashboard, in the Usage Center panel. Teams expecting to exceed them should license Nexus Repository Professional directly from Sonatype.

On your first sign-in Nexus presents a short onboarding wizard which asks you to accept Sonatype's end user licence agreement. cloudimg deliberately does not accept that agreement on your behalf — it is yours to read and accept — so expect it as the first thing you do. Until it is accepted, Nexus will not fetch or upload new components.

Connecting to your instance

Connect over SSH on port 22 using the key pair you selected at launch. The login user depends on the operating system variant you launched:

Replace <public-ip> with your instance's public IPv4 address, and your-key.pem with the private key file for the key pair you chose at launch.

Retrieving your administrator password

Nothing in this image ships with a usable login. On the first boot of each instance a one-shot service waits for Nexus to initialise, replaces the bootstrap password Nexus generates with a random per-instance password, disables anonymous access, verifies the new password authenticates, and writes it to a root-only file.

First confirm that first boot has finished and both services are running:

sudo systemctl is-active nexus.service nginx.service

Confirm the first-boot service completed and left its sentinel:

ls -l /var/lib/cloudimg/nexus-repository-firstboot.done

The credentials file is readable only by root. Check which fields it holds — this prints the field names only, never their values:

sudo grep -oE '^[A-Z_]+=' /root/nexus-credentials.txt

To read the password itself, print just that one field:

The username is admin. Treat this password as you would any production administrator credential, and change it from My Account → Change password once you have signed in.

Checking the service is healthy

nginx serves an unauthenticated health endpoint. It returns 200 as soon as the reverse proxy is serving, which makes it a ready-made health check for an Application Load Balancer target group:

curl -s -o /dev/null -w 'health: HTTP %{http_code}\n' http://127.0.0.1/health

Nexus itself answers its status endpoint on the loopback interface:

curl -s -o /dev/null -w 'nexus status: HTTP %{http_code}\n' http://127.0.0.1/service/rest/v1/status

Confirm Nexus is listening on loopback only — it is never published directly, nginx is the only front door:

sudo ss -tln | grep 8081

Confirm the JVM in use is the distribution's OpenJDK 21, not a bundled runtime:

java -version 2>&1 | head -1

Nexus is a JVM application, so a cold start takes a couple of minutes while it initialises. If the status endpoint is not yet answering, watch it come up:

sudo journalctl -u nexus.service --no-pager | tail -5

Signing in

Open http://<public-ip>/ in a browser and sign in as admin with the password from the credentials file. Work through the onboarding wizard, accepting Sonatype's licence agreement when prompted.

Anonymous access is disabled by default, so a freshly launched instance is never open to the internet. If you want unauthenticated read access to your public proxy repositories, enable it under Settings → Security → Anonymous Access.

The preconfigured repositories

Nexus initialises with a working set of Maven and NuGet repositories. Browse them under Browse in the left-hand navigation, where each row shows its type, format, online status and a copyable repository URL:

You can list the same set from the command line. This reads the administrator password into a shell variable so it is never printed:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/service/rest/v1/repositories | jq -r '.[] | "\(.name)\t\(.type)\t\(.format)"'

The three repository types are the whole model:

• proxy — caches a remote registry such as Maven Central or npmjs.org. Your builds pull from Nexus; Nexus fetches and caches from upstream once.
• hosted — stores artifacts you publish yourself, such as internal jars or private npm packages.
• group — presents several repositories behind one URL, so a build tool needs only a single entry.

Creating a repository

New repositories are created under Settings → Repository → Repositories → Create repository, where you pick a format and a type:

To add an npm proxy of the public registry from the command line:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'create npm-proxy: HTTP %{http_code}\n' -u "admin:$PW" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"name":"npm-proxy","online":true,"storage":{"blobStoreName":"default","strictContentTypeValidation":true},"proxy":{"remoteUrl":"https://registry.npmjs.org","contentMaxAge":1440,"metadataMaxAge":1440},"negativeCache":{"enabled":true,"timeToLive":1440},"httpClient":{"blocked":false,"autoBlock":true}}' \
  http://127.0.0.1/service/rest/v1/repositories/npm/proxy

A 201 means it was created. Confirm it is online:

PW=$(sudo grep '^NEXUS_ADMIN_PASSWORD=' /root/nexus-credentials.txt | cut -d= -f2-)
curl -s -u "admin:$PW" http://127.0.0.1/service/rest/v1/repositories | jq -r '.[] | select(.name=="npm-proxy") | "\(.name)\t\(.format)\t\(.type)\t\(.url)"'

Pointing your build tools at Nexus

Replace <public-ip> with your instance address (or your DNS name once you have attached one) in the examples below.

Maven — add a mirror to ~/.m2/settings.xml on your build machines so every dependency resolves through the maven-public group:

<settings>
  <mirrors>
    <mirror>
      <id>nexus</id>
      <name>cloudimg Nexus Repository</name>
      <url>http://<public-ip>/repository/maven-public/</url>
      <mirrorOf>*</mirrorOf>
    </mirror>
  </mirrors>
</settings>

npm — point the client at the npm proxy you created above:

Docker — Docker registry connectors listen on their own ports, so add a repository with a connector port under Settings → Repository → Repositories, then open that port in the instance's security group before pushing or pulling.

Storage and the data volume

Every blob store, the embedded database, the search index and the logs live on the dedicated data volume, separate from the operating system disk. Check its usage:

df -h /var/lib/nexus | tail -1

The volume is mounted by filesystem UUID so it survives reboots and instance replacement:

grep nexus /etc/fstab

An artifact repository grows steadily. To enlarge it, modify the EBS volume in the AWS console (or with aws ec2 modify-volume), then grow the filesystem in place — no downtime and no reinstall:

To keep storage in check, configure Settings → Repository → Cleanup Policies to remove snapshots and unused components on a schedule, and enable the Compact blob store task under Settings → System → Tasks.

Securing your instance

The image is secure by default — no security database and no bootstrap password ship in it, each instance mints its own administrator password, and anonymous access is off — but a few steps are yours:

• Restrict the security group. Port 80 is open so you can reach the UI. Narrow it to your office or VPC CIDR, and keep port 22 restricted to trusted addresses.
• Terminate TLS. Attach a DNS name and either put an AWS Application Load Balancer with an ACM certificate in front of the instance, or install Let's Encrypt on the instance itself. Serve credentials and artifacts over HTTPS only.
• Create per-team users and roles under Settings → Security, rather than sharing the admin account. Nexus supports fine-grained privileges per repository.
• Encrypt data at rest by enabling EBS encryption on the data volume.

Backing up

Nexus state is entirely within the data volume, so an EBS snapshot of it is a complete backup. Take snapshots on a schedule with AWS Backup or Data Lifecycle Manager.

For a consistent snapshot, stop Nexus first so the embedded database is not mid-write:

Nexus also ships a Backup task under Settings → System → Tasks which exports the databases to a directory you choose while the service keeps running — useful for a logical backup alongside the volume snapshots.

Troubleshooting

Useful log locations:

sudo tail -5 /var/lib/nexus/log/nexus.log

Support

cloudimg provides 24/7 technical support for this product with a guaranteed 24-hour response SLA. Contact us at support@cloudimg.co.uk for help with deployment, repository and build tool configuration, TLS, storage sizing, upgrades or troubleshooting.