Configuring Nexus Repository on Your CloudSOE Instance

This guide covers the layout and day-two configuration of the CloudSOE Nexus Repository image on both AWS and Azure. It assumes you’ve finished one of the getting-started guides (AWS, Azure).

File locations

Path	Purpose
`/opt/nexus`	Nexus application (owned by the `nexus` system user)
`/opt/nexus/bin/nexus.vmoptions`	JVM options — heap size, data directory flags
`/opt/nexus/nexus.secrets.json`	Per-instance secrets-encryption key (mode 600)
`/opt/sonatype-work/nexus3`	Working data — blob stores, database, config
`/opt/sonatype-work/nexus3/log/nexus.log`	Main application log
`/opt/sonatype-work/nexus3/admin.password`	One-time first-admin password (removed after the wizard)
`/usr/local/sbin/nexus-upgrade`	Experimental in-place upgrade helper

The service

Nexus is managed by systemd, runs as the unprivileged nexus user with a raised file-descriptor limit, and is enabled at boot:

sudo systemctl status nexus
sudo systemctl restart nexus       # after config changes; takes 2–3 minutes to come back

The one-time nexus-firstboot service only runs until its marker file (/var/lib/nexus-firstboot.done) exists.

The secrets-encryption key

Nexus encrypts stored credentials (proxy passwords, tokens, LDAP binds) with the key in /opt/nexus/nexus.secrets.json, generated uniquely for your instance at first boot and wired in via the service’s NEXUS_SECRETS_KEY_FILE environment variable.

Back this file up. If you rebuild the instance and restore /opt/sonatype-work without it, Nexus cannot decrypt any stored secrets.

JVM memory

Nexus defaults are conservative. On an 8 GB instance, raise the heap in /opt/nexus/bin/nexus.vmoptions:

-Xms2703m
-Xmx2703m
-XX:MaxDirectMemorySize=2703m

Sonatype’s guidance is to keep Xms and Xmx equal. Restart the nexus service afterwards.

Changing the port

Nexus listens on 8081 by default. To change it, set the property in /opt/sonatype-work/nexus3/etc/nexus.properties:

application-port=8082

Restart the service and update your security group / NSG rule to match.

Putting Nexus behind HTTPS

Nexus serves plain HTTP; terminate TLS in front of it:

A reverse proxy on the instance — install nginx, proxy 443 → 127.0.0.1:8081, and use Let’s Encrypt via certbot once a domain points at the instance.
A cloud load balancer — ALB with an ACM certificate on AWS, Application Gateway on Azure, forwarding to port 8081.

If clients will reach Nexus over HTTPS, set the base URL under Administration → System → General so redirects and emails use the right scheme, and restrict direct access to port 8081 once the proxy is in place.

Repositories and blob stores

All repository content lands in blob stores under /opt/sonatype-work/nexus3/blobs. Create additional blob stores and repositories in the UI (Administration → Repository). If artifacts will grow beyond the OS disk, attach a data disk, mount it, and create new blob stores on it rather than moving the defaults.

Next steps

Tips & tricks — the nexus-upgrade helper, backups, disk management and troubleshooting