Sonatype Nexus Repository - Artifact Manager

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## One Repository Manager for Every Package Format

Sonatype Nexus Repository is the universal artifact repository manager: a single self-hosted service that proxies, caches, hosts and groups packages across Maven, npm, Docker, NuGet, PyPI, RubyGems, Go, Helm, APT, YUM and raw formats. Point your builds at it once and every dependency your teams pull is cached locally, every internal artifact your pipelines publish has a home, and both are governed in one place.

This image delivers Nexus Repository fully installed and answering behind a hardened nginx reverse proxy, with its data directory already on a dedicated 100 GiB disk, so your repository is live within minutes of launch.

## Why This Image Instead of Self-Deploy

Standing up Nexus Repository by hand means pinning a Java runtime, creating a service account, relocating the data directory, writing systemd units that do not deadlock first boot, configuring a reverse proxy for large uploads, and rotating the bootstrap password before anyone can reach it. This image removes all of it:

• Current upstream release, deliberately not an end-of-life build
• Runs on the distribution's patched Java runtime, with no bundled runtime left in the image
• Dedicated blob store volume you can resize independently of the operating system disk
• Unique administrator password generated on first boot, with no usable credential in the image
• Reverse proxy pretuned for large uploads, with an unauthenticated health endpoint ready for load balancer probes
• 24/7 cloudimg support for deployment, configuration and troubleshooting

## How It Is Assembled

Nexus runs as an unprivileged service account under systemd, bound to the loopback interface only, with nginx published on port 80 in front of it. The entire data directory - every blob store, the embedded configuration and security database, the search index and the logs - sits on a dedicated disk snapshotted into the image and re-provisioned on every instance you launch. The embedded database means no separate database server to run, patch or pay for.

## Secure by Default

Nexus writes a bootstrap password to disk on first start. No such file, and no security database of any kind, exists in this image: it is wiped before capture. On first boot a one-shot service waits for the application to initialise, reads that bootstrap password, replaces it with a random per-instance password, disables anonymous access, verifies it authenticates, and records it in a root-only credentials file. Nothing else can log in, and no two instances ever share a password.

Only the reverse proxy is published on the instance interface. For HTTPS, point a DNS hostname at the instance and attach Let's Encrypt, or terminate TLS on an AWS Application Load Balancer. For data at rest, enable EBS encryption on the dedicated blob store volume.

## Use Cases

• Build dependency cache: Put a proxy repository in front of Maven Central, npm and PyPI so your pipelines stop pulling the same dependencies over the internet on every run, surviving upstream outages and cutting build times and egress.
• Internal artifact hosting: Publish your own jars, packages and container images to hosted repositories with fine-grained roles and permissions, keeping proprietary build output inside your own AWS account.
• Air-gapped and regulated builds: Run the single approved dependency source for an isolated environment, with grouped repositories presenting one endpoint to every build agent.

## Evaluate Quickly

Launch on an m5.large instance, read your administrator password from the root-only credentials file, and sign in. The image is production-ready from first boot, so you can create a repository and prove proxy caching straight away. On first sign-in Nexus presents its onboarding wizard, where you accept Sonatype's end user licence agreement before adding components. The paired cloudimg user guide covers that step, repository creation, DNS, TLS and build tool configuration: https://www.cloudimg.co.uk/guides/nexus-repository-aws/

## Editions and Licensing

This image ships the free tier of Nexus Repository, unmodified from the upstream release. No Sonatype commercial licence is installed and no Sonatype Professional capability is included or implied.

Sonatype's open source core is licensed under the Eclipse Public License 1.0. The free tier is distributed as Community Edition, which applies usage thresholds published by Sonatype, currently 40,000 total components and 100,000 requests per day, above which the addition of new components pauses until usage falls back below them. Teams expecting to exceed those thresholds should license Nexus Repository Professional directly from Sonatype. cloudimg is not affiliated with, endorsed by, or sponsored by Sonatype.