robonuka/nexus-https

•Updated 12 days ago

Sonatype Nexus Repository Manager with SSL access

Image

Databases & storage

6.5K

robonuka/nexus-https repository overview

Here is the complete solution how to setup Nexus Repository Manager as backend behind Nginx frontend with Letsencrypt SSL-certificates issuer/updater which has the correct Nginx-upstream to work with internal Nexus Docker repo by standard SSL TCP:443 port instead of it's real binding port, for example, TCP:8083

So finally you will be able to tag your docker images not like this:

repo.example.com:8083/myimage:1.0

but like this:

repo.example.com/myimage:1.0

⁠The solution steps see below

Step 1: Prepare folders structure for the Frontend Nginx and Letsencrypt issuer/updater containers

mkdir -p /opt/nginx-proxy/{acme.sh,certs,conf.d,html,htpasswd,logs,vhost.d}

Step 2: Generate file '/opt/nginx-proxy/dhparam.pem' with this command

openssl dhparam -out /opt/nginx-proxy/dhparam.pem 2048

Step 3: Create file '/opt/nginx-proxy/proxy.conf' with this content

proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
proxy_set_header Proxy "";

Step 4: Run these commands to prepare correct '/opt/nginx-proxy/nginx.tmpl' file

docker run -d -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy
cid=$(docker ps -aqf "ancestor=jwilder/nginx-proxy")
docker cp ${cid}:/app/nginx.tmpl /opt/nginx-proxy/nginx.tmpl
docker stop ${cid}
docker rm ${cid}
sed -ie 's/{{ $port := (coalesce $container.Env.VIRTUAL_PORT $defaultPort) }}/{{ $port := (when (eq (printf "%s" $container.Env.UPSTREAM_HOST) $host) (coalesce $container.Env.UPSTREAM_PORT) (coalesce $container.Env.VIRTUAL_PORT $defaultPort)) }}/g' /opt/nginx-proxy/nginx.tmpl

⁠For example:

FQDN = 'repo.example.com' we'll use for the Nexus WebUI.
FQDN = 'dockrepo.example.com' we'll use for the Nexus internal Docker repository.
Also we'll configure our Nexus internal Docker repository to use TCP:8083 port for the secure connections.

Step 5: Create file '/opt/docker-compose.yml' with content

services:
  nginx-proxy:
    container_name: nginx-proxy
    image: jwilder/nginx-proxy
    restart: unless-stopped
    ports:
      - 80:80/tcp
      - 443:443/tcp
    volumes:
      - /opt/nginx-proxy/proxy.conf:/etc/nginx/proxy.conf
      - /opt/nginx-proxy/certs:/etc/nginx/certs
      - /opt/nginx-proxy/conf.d:/etc/nginx/conf.d
      - /opt/nginx-proxy/html:/usr/share/nginx/html
      - /opt/nginx-proxy/vhost.d:/etc/nginx/vhost.d
      - /opt/nginx-proxy/dhparam.pem:/etc/nginx/dhparam/dhparam.pem
      - /opt/nginx-proxy/nginx.tmpl:/app/nginx.tmpl
      - /opt/nginx-proxy/logs:/var/log/nginx
      - /etc/localtime:/etc/localtime
      - /etc/timezone:/etc/timezone
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - example
  nginx-proxy-le:
    container_name: nginx-proxy-le
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: unless-stopped
    environment:
      - "NGINX_PROXY_CONTAINER=nginx-proxy"
      - "[email protected]"                                   
    volumes:
      - ./nginx-proxy/acme.sh:/etc/acme.sh                                       
      - ./nginx-proxy/certs:/etc/nginx/certs                                     
      - ./nginx-proxy/vhost.d:/etc/nginx/vhost.d                                 
      - ./nginx-proxy/html:/usr/share/nginx/html                                   
      - /etc/localtime:/etc/localtime
      - /etc/timezone:/etc/timezone
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - example
  nexus-https:
    container_name: nexus-https
    image: robonuka/nexus-https:latest
    restart: unless-stopped
    environment:
      - "VIRTUAL_HOST=repo.example.com,dockrepo.example.com"
      - "VIRTUAL_PORT=8443"
      - "VIRTUAL_PROTO=https"
      - "UPSTREAM_HOST=dockrepo.example.com"
      - "UPSTREAM_PORT=8083"
      - "LETSENCRYPT_HOST=repo.example.com,dockrepo.example.com"
      - "[email protected]"
      - "LETSENCRYPT_RESTART_CONTAINER=true"
      - "INSTALL4J_ADD_VM_PARAMS=-Xms2g -Xmx2g -XX:MaxDirectMemorySize=2g"
      - "PUBLIC_CERT=/opt/sonatype/nexus/etc/ssl/fullchain.pem"
      - "PRIVATE_KEY=/opt/sonatype/nexus/etc/ssl/key.pem"
      - "PRIVATE_KEY_PASSWORD='VeRySeCreT'"
    depends_on:
      - nginx-proxy
    expose:
      - 8443/tcp
    ports:
      - 8083:8083/tcp
    volumes:
      - ./nginx-proxy/certs/repo.example.com:/opt/sonatype/nexus/etc/ssl
      - /data/nexus-https:/nexus-data
    networks:
      - example
networks:
  example:
    driver: "bridge"

Before you doing the next steps check that:

Your firewall rules allow incoming connections to the TCP:80 and TCP:443 ports
You have the correct DNS 'A'-records for the 'repo.example.com' and 'dockrepo.example.com'

Step 6: For the first run you should start the frontend containers only

cd /opt
docker compose up -d nginx-proxy nginx-proxy-le

Output should be:

Creating network "opt_example" with driver "bridge"
Creating nginx-proxy-le ... done
Creating nginx-proxy    ... done

Waiting for 10-15 seconds and then check that both containers Up and running

docker ps

Output should be like this:

CONTAINER ID   IMAGE                                    COMMAND                  CREATED          STATUS          PORTS                                                                      NAMES
3dd371ea9244   jwilder/nginx-proxy                      "/app/docker-entrypo…"   14 seconds ago   Up 13 seconds   0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp   nginx-proxy
2c85483f9c6d   jrcs/letsencrypt-nginx-proxy-companion   "/bin/bash /app/entr…"   14 seconds ago   Up 13 seconds                                                                              nginx-proxy-le

Step 7: Start the Nexus-https container

docker compose up -d nexus-https

That's it!
After 20-30 seconds you'll get your own Nexus repository wich is works with SSL-certificates correctly.
And which has correct frontend Nginx-upstream settings for your backend internal Docker repository.

Tag summary

Recent tags

Content type

Image

Digest

sha256:031944eab…

Size

446.7 MB

Last updated

12 days ago

docker pull robonuka/nexus-https