Configure Sonatype Nexus for Maven, npm, PyPI & Docker Artifacts
We configure Sonatype Nexus as a unified artifact repository that combines Maven, npm, PyPI, and Docker in one place. This eliminates scattered solutions and guarantees stable builds even in isolated networks. Without Nexus, each build re-downloads dependencies from scratch; when Docker Hub rate limiting kicks in (100 pulls per 6 hours for anonymous users), your pipeline can fail. We solve this: Nexus caches packages locally and pins versions, speeding up CI/CD by 2–3×. Our experience: 10+ years in DevOps, 30+ Nexus deployments.
Why Nexus for Enterprise Repositories?
Nexus Repository Manager supports proxying and hosting for all major formats: Maven (Java), npm (JS), PyPI (Python), Docker (containers), as well as Helm, NuGet, apt, yum. In air-gapped environments (industrial networks, compliance requirements), an automated pipeline is impossible without Nexus. A properly configured Nexus cuts build time by 40% (average across our projects) and reduces consumed traffic by 80% through local caching. It eliminates issues with external registry rate limiting. Compared to Artifactory, Nexus licensing is cheaper for small businesses (up to 5× less), though it lacks support for some formats. However, for typical stacks, Nexus covers all needs.
How Sonatype Nexus Accelerates CI/CD and Build Reliability
A CI/CD pipeline pulls dependencies directly from Maven Central, npm registry, and Docker Hub every time. With unstable internet or rate limiting (Docker Hub: 100 pulls/6 hours for anonymous users), builds start failing. When dependencies update “silently,” behavior changes—versions are not pinned in the corporate cache. In air-gapped environments (industrial networks, compliance), the pipeline simply doesn't work without Nexus. Nexus solves all these problems: caching via proxy repositories, version pinning through hosted repositories, and a group repository as a single entry point.
Nexus Installation
docker-compose.yml for Nexus
# docker-compose.yml
services:
nexus:
image: sonatype/nexus3:3.68.0
container_name: nexus
ports:
- "8081:8081" # Web UI and Maven/npm/PyPI
- "5000:5000" # Docker hosted registry
- "5001:5001" # Docker proxy registry
volumes:
- nexus-data:/nexus-data
environment:
- INSTALL4J_ADD_VM_PARAMS=-Xms2703m -Xmx2703m -XX:MaxDirectMemorySize=2703m
restart: unless-stopped
volumes:
nexus-data:
driver: local
Nexus requires at least 4 GB RAM. The initial password is at cat /data/nexus/admin.password. After first login, change the password and enable anonymous read access (for CI without authentication on pull).
Repository Configuration
Nexus works with three repository types: Hosted, Proxy, Group.
| Type | Description | Example Use |
|---|---|---|
| Hosted | Store own artifacts | Internal libraries, builds |
| Proxy | Proxy to external registry with cache | Docker Hub, Maven Central |
| Group | Combine Hosted + Proxy into one URL | Single access point for CI |
| Port | Purpose |
|---|---|
| 8081 | Web UI, Maven, npm, PyPI |
| 5000 | Docker hosted registry |
| 5001 | Docker proxy registry |
Maven:
- maven-central (proxy -> https://repo1.maven.org/maven2)
- maven-releases (hosted, policy: release)
- maven-snapshots (hosted, policy: snapshot)
- maven-public (group: maven-releases + maven-snapshots + maven-central)
In developer's settings.xml — only the group URL:
<settings>
<mirrors>
<mirror>
<id>nexus</id>
<mirrorOf>*</mirrorOf>
<url>https://nexus.company.ru/repository/maven-public/</url>
</mirror>
</mirrors>
<servers>
<server>
<id>nexus</id>
<username>deploy</username>
<password>${env.NEXUS_PASSWORD}</password>
</server>
</servers>
</settings>npm:
# Configure npm to use Nexus
npm config set registry https://nexus.company.ru/repository/npm-group/
npm config set //nexus.company.ru/repository/npm-group/:_authToken ${NEXUS_NPM_TOKEN}
# Publish internal package
npm publish --registry https://nexus.company.ru/repository/npm-hosted/PyPI:
# ~/.config/pip/pip.conf
[global]
index-url = https://nexus.company.ru/repository/pypi-group/simple/
trusted-host = nexus.company.ruDocker:
For Docker, separate ports are needed (Nexus cannot share Docker registry by path, only by port). Configure Docker daemon as insecure registry if no TLS.
docker pull nexus.company.ru:5001/library/nginx:1.25
docker tag my-app:1.0 nexus.company.ru:5000/my-app:1.0
docker push nexus.company.ru:5000/my-app:1.0Storage and Cleanup Policies
Without cleanup policies, nexus-data grows uncontrollably. Configure in Administration → Cleanup Policies:
- Maven snapshots: delete artifacts older than 30 days or if more than 5 versions per artifact
- Docker images: delete untagged images, keep last 10 tags per image
- npm: delete versions older than 90 days if a newer one exists
Policies can be applied manually or on a schedule via Tasks → Execute Cleanup Policies.
Security and Authentication
Nexus supports LDAP and SAML for authentication. Roles: anonymous (read-only for public), developer (read + publish to hosted), admin. For CI/CD, create a dedicated ci-deploy user with minimal permissions — only push to relevant repositories.
How to Configure Nexus Step by Step
- Deploy Nexus via Docker Compose or standalone Java.
- Get the initial password and perform the first login.
- Create Hosted, Proxy, and Group repositories for each format.
- Set up cleanup policies and authentication via LDAP or SAML.
- Integrate Nexus with CI/CD and train the team.
Example: Nexus Configuration for a Fintech Startup with Air-Gapped Environment
One of our projects — a fintech startup that needed to deploy Nexus in an isolated network without internet access. We set up proxy repositories, pre-loading the cache for Maven Central (about 500 popular libraries) and Docker Hub (base images for Java, Python, Node). The result: builds no longer depend on external registries, build time dropped from 15 to 5 minutes (67% reduction), and security improved through version control via hosted repositories.
What's Included in the Work
We provide the full Nexus configuration cycle:
- Deploy Nexus in Docker or on a VM with JVM optimization
- Configure Maven, npm, PyPI, Docker repositories with proxying and caching
- Integrate with CI/CD (GitLab CI, Jenkins, GitHub Actions) and LDAP/SAML
- SSL termination via reverse proxy (nginx)
- Cleanup policies and backups
- Documentation for teams and training
Estimated Timelines and CTA
A standard Nexus setup takes from 3 to 5 days. Complexity depends on the number of formats, security requirements, and integration with existing infrastructure. Get a consultation — we will evaluate your project in one day. Order Nexus configuration and forget about dependency problems. Contact us to discuss your case — we will prepare the optimal solution.