|
| 1 | +# Nexus Configuration as Code |
| 2 | + |
| 3 | +Nexus CasC is a configuration as code plugin for sonatype nexus 3. |
| 4 | + |
| 5 | +This plugin allows to specify a YAML file to configure a Nexus instance on startup. |
| 6 | + |
| 7 | +## Usage |
| 8 | + |
| 9 | +### Docker |
| 10 | + |
| 11 | +When using docker the easiest way to get started is to use the `sventschui/nexus-casc` image that inherits form `sonatype/nexus3`. |
| 12 | + |
| 13 | +The docker image supports the same options as the `sonatype/nexus3` image plus the following additions. |
| 14 | + |
| 15 | +It expects a YAML configuration file to be mounted to `/opt/nexus.yml` (This path can be overridden using the `NEXUS_CASC_CONFIG` env var). |
| 16 | + |
| 17 | +The format of the YAML file is documented below. |
| 18 | + |
| 19 | +### Manual installation |
| 20 | + |
| 21 | +Download the Nexus CasC plugin [here TODO](TODO) and copy it into the `systems` folder of your nexus installation. |
| 22 | +This folder resides in `/opt/sonatype/nexus/system/` when using the `sonatype/nexus3` docker image. |
| 23 | + |
| 24 | +Append the following line to the `etc/karaf/startup.properties` (`/opt/sonatype/nexus/etc/karaf/startup.properties` in the `sonatype/nexus3` docker image) file. |
| 25 | +Replace the `<NEXUS_CASC_VERSION>` placeholder with the version of the Nexus CasC plugin you downloaded. |
| 26 | + |
| 27 | +``` |
| 28 | +reference\:file\:nexus-casc-plugin-<NEXUS_CASC_VERSION>.jar = 199 |
| 29 | +``` |
| 30 | + |
| 31 | +Create a YAML configuration file (as documented below) and add its path to the `NEXUS_CASC_CONFIG` |
| 32 | +environment variable. |
| 33 | + |
| 34 | +Now you can start Nexus as usual. |
| 35 | + |
| 36 | +## Configuration file |
| 37 | + |
| 38 | +You can find an example configuration file [here](https://github.com/sventschui/nexus-casc-plugin/blob/master/default-nexus.yml). |
| 39 | + |
| 40 | +Use ${ENV_VAR} for env var interpolation. |
| 41 | + |
| 42 | +The configuration file supports following options: |
| 43 | + |
| 44 | +### Core |
| 45 | + |
| 46 | +```yaml |
| 47 | +core: |
| 48 | + baseUrl: "" # Nexus base URL |
| 49 | + httpProxy: "" # HTTP proxy (Note: Basic Auth and NTLM are not yet supported, file an issue if you require this) |
| 50 | + httpsProxy: "" # HTTP proxy |
| 51 | + nonProxyHosts: "" # Comma separated list of hosts not to be queried through a proxy |
| 52 | +``` |
| 53 | +
|
| 54 | +### Security |
| 55 | +
|
| 56 | +```yaml |
| 57 | +security: |
| 58 | + anonymousAccess: false # Enable/Disable anonymous access |
| 59 | + pruneUsers: true # True to delete users not part of this configuration file |
| 60 | + realms: # Authentication realms, tested for rutauth-realm only |
| 61 | + - name: rutauth-realm |
| 62 | + enabled: true |
| 63 | + users: |
| 64 | + - username: johndoe |
| 65 | + firstName: John |
| 66 | + lastName: Doe |
| 67 | + password: ${USER_JOHNDOE_PASSWORD} |
| 68 | + updateExistingPassword: false # True to update passwords of existing users, otherwise password is only used when creating a user |
| 69 | + email: johndoe@example.org |
| 70 | + roles: |
| 71 | + - source: "" |
| 72 | + role: nx-admin |
| 73 | +``` |
| 74 | +
|
| 75 | +
|
| 76 | +### Repository |
| 77 | +
|
| 78 | +```yaml |
| 79 | +repository: |
| 80 | + pruneBlobStores: true # True to delete blob stores not present in this configuration file |
| 81 | + blobStores: # List of blob stores to create |
| 82 | + - name: maven |
| 83 | + type: File |
| 84 | + attributes: |
| 85 | + file: |
| 86 | + path: maven |
| 87 | + blobStoreQuotaConfig: |
| 88 | + quotaLimitBytes: 10240000000 |
| 89 | + quotaType: spaceUsedQuota |
| 90 | + - name: npm |
| 91 | + type: File |
| 92 | + attributes: |
| 93 | + file: |
| 94 | + path: npm |
| 95 | + blobStoreQuotaConfig: |
| 96 | + quotaLimitBytes: 10240000000 |
| 97 | + quotaType: spaceUsedQuota |
| 98 | + - name: docker |
| 99 | + type: File |
| 100 | + attributes: |
| 101 | + file: |
| 102 | + path: docker |
| 103 | + blobStoreQuotaConfig: |
| 104 | + quotaLimitBytes: 10240000000 |
| 105 | + quotaType: spaceUsedQuota |
| 106 | + pruneCleanupPolicies: true # True to delete cleanup policies not present in this configuration file |
| 107 | + cleanupPolicies: |
| 108 | + - name: cleanup-maven-proxy |
| 109 | + format: maven2 |
| 110 | + notes: '' |
| 111 | + criteria: |
| 112 | + lastDownloadBefore: 10 |
| 113 | + - name: cleanup-npm-proxy |
| 114 | + format: npm |
| 115 | + notes: '' |
| 116 | + criteria: |
| 117 | + lastDownloadBefore: 10 |
| 118 | + - name: cleanup-docker-proxy |
| 119 | + format: docker |
| 120 | + notes: '' |
| 121 | + criteria: |
| 122 | + lastDownloaded: 864000 |
| 123 | + pruneRepositories: true # True to delete repositories not present in this configuration file |
| 124 | + repositories: |
| 125 | + - name: npm-proxy |
| 126 | + online: true |
| 127 | + recipeName: npm-proxy |
| 128 | + attributes: |
| 129 | + proxy: |
| 130 | + remoteUrl: https://registry.npmjs.org |
| 131 | + contentMaxAge: -1.0 |
| 132 | + metadataMaxAge: 1440.0 |
| 133 | + httpclient: |
| 134 | + blocked: false |
| 135 | + autoBlock: true |
| 136 | + connection: |
| 137 | + useTrustStore: false |
| 138 | + storage: |
| 139 | + blobStoreName: npm |
| 140 | + strictContentTypeValidation: true |
| 141 | + routingRules: |
| 142 | + routingRuleId: null |
| 143 | + negativeCache: |
| 144 | + enabled: true |
| 145 | + timeToLive: 1440.0 |
| 146 | + cleanup: |
| 147 | + policyName: cleanup-npm-proxy |
| 148 | + - name: npm-hosted |
| 149 | + online: true |
| 150 | + recipeName: npm-hosted |
| 151 | + attributes: |
| 152 | + storage: |
| 153 | + blobStoreName: npm |
| 154 | + strictContentTypeValidation: true |
| 155 | + writePolicy: ALLOW_ONCE |
| 156 | + cleanup: |
| 157 | + policyName: None |
| 158 | + - name: npm |
| 159 | + online: true |
| 160 | + recipeName: npm-group |
| 161 | + attributes: |
| 162 | + storage: |
| 163 | + blobStoreName: npm |
| 164 | + strictContentTypeValidation: true |
| 165 | + group: |
| 166 | + memberNames: |
| 167 | + - "npm-proxy" |
| 168 | + - "npm-hosted" |
| 169 | + - name: maven-snapshots |
| 170 | + online: true |
| 171 | + recipeName: maven2-hosted |
| 172 | + attributes: |
| 173 | + maven: |
| 174 | + versionPolicy: SNAPSHOT |
| 175 | + layoutPolicy: STRICT |
| 176 | + storage: |
| 177 | + writePolicy: ALLOW |
| 178 | + strictContentTypeValidation: false |
| 179 | + blobStoreName: maven |
| 180 | + - name: maven-central |
| 181 | + online: true |
| 182 | + recipeName: maven2-proxy |
| 183 | + attributes: |
| 184 | + proxy: |
| 185 | + contentMaxAge: -1 |
| 186 | + remoteUrl: https://repo1.maven.org/maven2/ |
| 187 | + metadataMaxAge: 1440 |
| 188 | + negativeCache: |
| 189 | + timeToLive: 1440 |
| 190 | + enabled: true |
| 191 | + storage: |
| 192 | + strictContentTypeValidation: false |
| 193 | + blobStoreName: maven |
| 194 | + httpClient: |
| 195 | + connection: |
| 196 | + blocked: false |
| 197 | + autoBlock: true |
| 198 | + maven: |
| 199 | + versionPolicy: RELEASE |
| 200 | + layoutPolicy: PERMISSIVE |
| 201 | + cleanupPolicy: |
| 202 | + name: cleanup-maven-proxy |
| 203 | + httpclient: |
| 204 | + maven-indexer: |
| 205 | + - name: maven-tudelft |
| 206 | + online: true |
| 207 | + recipeName: maven2-proxy |
| 208 | + attributes: |
| 209 | + proxy: |
| 210 | + contentMaxAge: -1 |
| 211 | + remoteUrl: https://simulation.tudelft.nl/maven/ |
| 212 | + metadataMaxAge: 1440 |
| 213 | + negativeCache: |
| 214 | + timeToLive: 1440 |
| 215 | + enabled: true |
| 216 | + storage: |
| 217 | + strictContentTypeValidation: false |
| 218 | + blobStoreName: maven |
| 219 | + httpClient: |
| 220 | + connection: |
| 221 | + blocked: false |
| 222 | + autoBlock: true |
| 223 | + maven: |
| 224 | + versionPolicy: RELEASE |
| 225 | + layoutPolicy: PERMISSIVE |
| 226 | + cleanupPolicy: |
| 227 | + name: cleanup-maven-proxy |
| 228 | + httpclient: |
| 229 | + maven-indexer: |
| 230 | + - name: maven-public |
| 231 | + online: true |
| 232 | + recipeName: maven2-group |
| 233 | + attributes: |
| 234 | + maven: |
| 235 | + versionPolicy: MIXED |
| 236 | + group: |
| 237 | + memberNames: |
| 238 | + - "maven-central" |
| 239 | + - "maven-snapshots" |
| 240 | + - "maven-tudelft" |
| 241 | + storage: |
| 242 | + blobStoreName: maven |
| 243 | + - name: docker-hosted |
| 244 | + online: true |
| 245 | + recipeName: docker-hosted |
| 246 | + attributes: |
| 247 | + docker: |
| 248 | + forceBasicAuth: true |
| 249 | + v1Enabled: false |
| 250 | + storage: |
| 251 | + blobStoreName: docker |
| 252 | + strictContentTypeValidation: true |
| 253 | + writePolicy: ALLOW_ONCE |
| 254 | + cleanup: |
| 255 | + policyName: None |
| 256 | + - name: docker-proxy |
| 257 | + online: true |
| 258 | + recipeName: docker-proxy |
| 259 | + attributes: |
| 260 | + docker: |
| 261 | + forceBasicAuth: true |
| 262 | + v1Enabled: false |
| 263 | + proxy: |
| 264 | + remoteUrl: https://registry-1.docker.io |
| 265 | + contentMaxAge: -1.0 |
| 266 | + metadataMaxAge: 1440.0 |
| 267 | + dockerProxy: |
| 268 | + indexType: REGISTRY |
| 269 | + httpclient: |
| 270 | + blocked: false |
| 271 | + autoBlock: true |
| 272 | + connection: |
| 273 | + useTrustStore: false |
| 274 | + storage: |
| 275 | + blobStoreName: docker |
| 276 | + strictContentTypeValidation: true |
| 277 | + routingRules: |
| 278 | + routingRuleId: null |
| 279 | + negativeCache: |
| 280 | + enabled: true |
| 281 | + timeToLive: 1440.0 |
| 282 | + cleanup: |
| 283 | + policyName: cleanup-docker-proxy |
| 284 | + - name: docker |
| 285 | + online: true |
| 286 | + recipeName: docker-group |
| 287 | + attributes: |
| 288 | + docker: |
| 289 | + forceBasicAuth: true |
| 290 | + v1Enabled: false |
| 291 | + storage: |
| 292 | + blobStoreName: docker |
| 293 | + strictContentTypeValidation: true |
| 294 | + group: |
| 295 | + memberNames: |
| 296 | + - "docker-hosted" |
| 297 | + - "docker-proxy" |
| 298 | +``` |
0 commit comments