Getting Started with Nexus Repository on Azure

The CloudSOE Nexus Repository image gives you Sonatype Nexus Repository 3 — proxying and hosting Maven, npm, Docker, PyPI and more — on a hardened Ubuntu base with OpenJDK 17. The image contains no baked-in secrets: on first boot your VM generates its own secrets-encryption key, and Nexus writes a one-time admin password that you replace in the setup wizard.

What you’ll need

• An Azure subscription
• An SSH public key (password login is disabled in the image)
• About ten minutes

Step 1 — Create the VM

1. Find the CloudSOE Nexus Repository offer in the Azure Marketplace and click Create.
2. Choose a resource group, region and VM name.
3. Pick a size with at least 8 GB RAM — Standard_D2as_v4 (2 vCPU, 8 GB) is a good starting point; Nexus is a JVM application that appreciates memory.
4. Under Administrator account, select SSH public key, pick a username (e.g. azureuser) and paste your key.
5. Create or attach a public IP. For production, make it Static — your build tools will all point at this address.
6. Size the OS disk generously if you’ll host large artifact repositories, since blob stores live on it.

Step 2 — Open the firewall ports

In the VM’s network security group, allow inbound:

Restrict both to your own IP range (or your build infrastructure’s range) where possible.

Step 3 — Let first boot finish

On the very first boot the nexus-firstboot service:

• generates a unique per-instance secrets-encryption key at /opt/nexus/nexus.secrets.json (never baked into the image),
• fills your public IP into the login banner,
• restarts Nexus so the key takes effect.

Nexus itself takes two to three minutes to start. You can watch:

ssh <admin-user>@<public-ip>
systemctl status nexus-firstboot nexus

Step 4 — Retrieve the first-admin password

Nexus writes a one-time password for the admin user on its first start:

sudo cat /opt/sonatype-work/nexus3/admin.password

This file is deleted automatically once you complete the setup wizard — it’s a bootstrap secret, not a permanent credential.

Step 5 — Complete the setup wizard

From your own machine (an Azure VM often cannot reach its own public IP from inside), browse to http://<public-ip>:8081, click Sign in and log in as admin with the one-time password. The wizard walks you through:

1. Setting a new admin password of your own.
2. Choosing whether anonymous users may browse and download — for an internet-facing instance, disable anonymous access unless you specifically want a public repository.

You now have a working repository manager with the default Maven repositories in place.

Next steps

• Configure Nexus — file locations, ports, memory, the encryption key and HTTPS
• Tips & tricks — the nexus-upgrade helper, backups, disk management and troubleshooting