Nexus Repository Behind Nginx

04/12/2025

2 Views 0

SaveSavedRemoved 0

A Practical Guide to Configuring Nexus Repository Behind an Nginx Reverse Proxy

Setting up a robust and secure instance of Sonatype Nexus Repository Manager is a cornerstone of modern DevOps and software development workflows. While Nexus can run perfectly well on its own, placing it behind a powerful web server like Nginx acting as a reverse proxy elevates your setup from a basic installation to a professional, secure, and easily accessible service.

Using Nginx as a reverse proxy is the industry-standard approach for exposing services like Nexus to your network or the internet. This configuration provides significant advantages in security, performance, and management.

Key Benefits of Using an Nginx Reverse Proxy

Before diving into the configuration, it’s important to understand why this is the recommended approach:

SSL/TLS Termination: You can manage your SSL certificates and enforce HTTPS directly on Nginx. This centralizes your security management and simplifies the Nexus configuration, as Nexus itself no longer needs to handle the complexities of SSL.
Standard Port Access: Nginx allows you to expose Nexus on standard web ports like 80 (HTTP) and 443 (HTTPS), even though Nexus runs on a different port internally (e.g., 8081). This provides a cleaner, more professional URL for your users (e.g., https://nexus.yourcompany.com instead of http://your-server:8081).
Simplified URL and Context Path: You can configure a clean base URL without needing a complex context path, improving user experience and simplifying integrations with other tools.
Centralized Access Control and Logging: Nginx can provide an additional layer of access control, request logging, and even rate limiting, all before traffic ever reaches the Nexus application.

Step 1: Prepare Your Nexus Repository Configuration

The first step is to ensure Nexus is aware that it will be operating behind a proxy. This is a crucial step that prevents issues with how Nexus generates URLs and handles requests.

You need to modify the primary Nexus properties file. Locate the nexus.properties file, which is typically found within the etc/ directory of your Sonatype work directory (e.g., /opt/sonatype-work/nexus3/etc/nexus.properties).

Open this file and add or uncomment the following line:

# Nexus context path
nexus.web.contextpath=/

This setting is critical. The nexus.web.contextpath=/ tells Nexus that it is the root application at the domain where it’s being served. This ensures that all resources, links, and API endpoints are generated correctly without any extra path prefixes.

After saving this change, you must restart the Nexus service for the new configuration to take effect.

Step 2: Configure the Nginx Reverse Proxy

With Nexus properly configured, you can now set up Nginx to handle incoming requests and forward them appropriately. This involves creating a new server block configuration file for your Nexus instance. On most Linux systems, you would create a new file in /etc/nginx/sites-available/nexus.conf.

Here is a complete and robust Nginx configuration example. This template includes SSL termination, proper header forwarding, and recommended timeout settings.

server {
    listen 80;
    server_name nexus.yourdomain.com;

    # Redirect all HTTP traffic to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name nexus.yourdomain.com;

    # SSL Certificate Configuration
    ssl_certificate /etc/letsencrypt/live/nexus.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nexus.yourdomain.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Proxy Buffering and Timeout Settings
    proxy_send_timeout 120s;
    proxy_read_timeout 300s;
    proxy_buffering off;
    client_max_body_size 1G; # Adjust for your expected artifact size

    location / {
        # The address where Nexus is running internally
        proxy_pass http://127.0.0.1:8081;

        # Forwarding essential headers to Nexus
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Dissecting the Nginx Configuration

Let’s break down the most important directives in this configuration:

HTTP to HTTPS Redirect: The first server block listens on port 80 and performs a permanent (301) redirect to the HTTPS version of the site. This is a security best practice.
listen 443 ssl http2;: This tells Nginx to listen for secure traffic on port 443 and enables HTTP/2 for better performance.
ssl_certificate and ssl_certificate_key: These directives point to your SSL certificate files. You should replace the example paths with the actual paths to your certificates (e.g., from Let’s Encrypt or another certificate authority).
proxy_pass http://127.0.0.1:8081;: This is the core of the reverse proxy. It instructs Nginx to forward all incoming requests for this server block to the Nexus application running on localhost at port 8081.
proxy_set_header: These lines are absolutely essential for proper operation.
- Host $host;: Passes the original hostname requested by the client (e.g., nexus.yourdomain.com) to Nexus.
- X-Real-IP $remote_addr;: Forwards the real IP address of the client.
- X-Forwarded-For $proxy_add_x_forwarded_for;: A standard header containing the chain of IP addresses a request has passed through.
- X-Forwarded-Proto $scheme;: This is one of the most critical headers. It tells Nexus whether the original client request was http or https. Without it, Nexus may generate incorrect URLs and cause redirect loops or mixed-content warnings in the browser.
client_max_body_size 1G;: This setting increases the maximum allowed size of a client request body. It is vital for allowing developers to upload large artifacts or packages to the repository. Adjust this value based on your needs.

Final Steps and Verification

Once you have created your Nginx configuration file, follow these final steps to enable it:

Enable the Site: If you are using the sites-available and sites-enabled structure, create a symbolic link to enable your new configuration:
bash sudo ln -s /etc/nginx/sites-available/nexus.conf /etc/nginx/sites-enabled/
Test the Configuration: Always test your Nginx configuration for syntax errors before reloading the service.
bash sudo nginx -t
If the test is successful, you will see a confirmation message.
Reload Nginx: Apply the new configuration by gracefully reloading the Nginx service.
bash sudo systemctl reload nginx

After reloading, you should be able to access your Nexus Repository Manager by navigating to https://nexus.yourdomain.com in your web browser. The entire experience should be seamless, secure, and professional, with all traffic encrypted and served from a clean, memorable URL.

Source: https://kifarunix.com/run-nexus-repository-behind-nginx-reverse-proxy/