Artifact Management with Nexus and Artifactory

By Kokil Thapa | Last reviewed: September 2026

Your build breaks at 2 a.m. because Packagist timed out again. A teammate pinned a dependency locally, but nobody else can reproduce the release. Artifact Management with Nexus and Artifactory fixes that class of problem by giving your team a private, cached, versioned store for packages, containers, and build outputs. On production Linux system administration work and Laravel deployments I maintain, a local repository manager sits between the internet and every CI job — and the difference in reliability is immediate.

What is artifact management and why does CI/CD need it?

An artifact is any immutable build output you ship or depend on: a Composer package, an npm tarball, a Docker image layer, a Deployer release archive, or a Vite build bundle. Artifact management is the practice of storing, indexing, scanning, and serving those files through a controlled repository layer.

Without it, every pipeline run hits public registries directly. That creates three recurring failures I see on client projects:

• Non-reproducible builds — upstream tags move, mirrors fail, or a semver range resolves to a different patch on Tuesday than on Monday.
• Slow pipelines — downloading the same 400 MB Docker base image or 120 Composer packages on every job wastes minutes and bandwidth.
• Supply-chain risk — a compromised public package lands in production because nobody cached or scanned dependencies centrally.

A repository manager sits in the middle. Developers and CI authenticate once. The manager proxies public feeds, caches responses, and hosts your private packages. That pattern pairs naturally with CI/CD secrets management best practices because tokens for the repository live in GitLab variables or Vault — not in committed config files.

The two dominant self-hosted options are Sonatype Nexus Repository and JFrog Artifactory. Both solve the same core problem. They differ in licensing, ecosystem depth, and how much security scanning you want baked in from day one.

How do Nexus Repository and JFrog Artifactory compare?

Teams usually pick one repository manager and standardise every language on it. Splitting Composer to Nexus and Docker to Artifactory doubles credential sprawl and audit work. Compare them on criteria that matter in small-to-mid production teams — not feature checklists you will never enable.

For a Laravel shop running GitLab CI and Deployer 7 on Ubuntu, either tool works. I have seen Nexus OSS adopted first because the Composer and npm proxy setup takes an afternoon. Artifactory wins when the same organisation already runs Xray for vulnerability management automation across Docker images and Maven artefacts.

Cloud-native alternatives exist — GitLab Package Registry, GitHub Packages, and Azure Artifacts — and they reduce ops overhead. Self-hosted Nexus or Artifactory still makes sense when you want one cache in Kathmandu or on a private VPC, air-gapped compliance, or unified storage across PHP, Node, and Docker without per-platform egress fees. Read the Azure Artifacts private package feeds guide if you are weighing cloud-only options.

How do you set up artifact management for PHP Composer and npm?

Most Laravel 12 and Laravel 13 projects pull PHP packages through Composer 2.10 and front-end assets through npm 12 with Vite 8.x. Point both at your repository manager using proxy repositories — not by mirroring the entire internet onto disk on day one.

Repository types you need

1. Proxy repository — forwards requests to Packagist or registry.npmjs.org and caches successful responses.
2. Hosted repository — stores your internal packages, such as a shared validation library across legal-tech portals.
3. Group repository — merges proxy and hosted repos behind one URL so clients need a single endpoint.

Nexus example: Composer proxy + group

After installing Nexus on Ubuntu 24.04, create these repositories in the admin UI or via REST API:

• composer-proxy — remote URL https://repo.packagist.org
• composer-hosted — for internal packages
• composer-group — members: hosted first, then proxy

Point the project composer.json at the group URL. Use an auth token in CI, never in Git:

{
  "repositories": [
    {
      "type": "composer",
      "url": "https://nexus.example.com/repository/composer-group/"
    }
  ],
  "config": {
    "secure-http": true
  }
}

Set credentials through COMPOSER_AUTH in GitLab CI variables:

export COMPOSER_AUTH='{"http-basic":{"nexus.example.com":{"username":"ci-bot","password":"'"$NEXUS_PASSWORD"'"}}}'

The official Composer documentation describes repository types and authentication headers in detail — follow that spec rather than inventing custom download scripts.

Artifactory example: npm and Composer

Artifactory uses a similar model with remote, local, and virtual repositories. Create a virtual repo named npm-all that aggregates your cached npm remote and a local scope for private packages. For Composer, bind a Composer local repo and attach a remote pointing at Packagist.

Configure npm once per runner:

npm config set registry https://artifactory.example.com/artifactory/api/npm/npm-all/
npm config set //artifactory.example.com/artifactory/api/npm/npm-all/:_authToken "$ARTIFACTORY_TOKEN"

On a production Laravel application, commit composer.lock and package-lock.json. Run composer install --no-dev --prefer-dist and npm ci in CI so the repository manager serves exact versions from cache. That single habit eliminates an entire category of "works on my machine" deploy failures.

How do you wire Nexus or Artifactory into GitLab CI and Deployer?

Several sister sites I maintain share a GitLab CI plus Deployer 7 pipeline on shared EC2 infrastructure. The same pattern applies whether you cache dependencies or publish release bundles.

GitLab CI job skeleton

Cache Composer and npm directories on the runner, but still pull through the repository manager. Caches speed up jobs; the manager guarantees immutability when a cache is cold.

stages:
  - build

variables:
  COMPOSER_CACHE_DIR: "$CI_PROJECT_DIR/.composer-cache"

build:
  image: php:8.4-cli
  stage: build
  before_script:
    - apt-get update && apt-get install -y git unzip
    - curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
    - export COMPOSER_AUTH="{\"http-basic\":{\"nexus.example.com\":{\"username\":\"$NEXUS_USER\",\"password\":\"$NEXUS_PASS\"}}}"
  script:
    - composer install --no-dev --prefer-dist --no-interaction
    - npm ci --prefer-offline
    - npm run build

Store NEXUS_USER and NEXUS_PASS as masked protected variables. Rotate them quarterly. Pair this with HashiCorp Vault secrets management if you already centralise credentials for multiple environments.

Publishing build artefacts back to the repository

Some teams push generic ZIP archives of Vite output or migration bundles to a raw repository for audit. Upload with a deterministic path that includes the Git commit SHA:

curl -u "$NEXUS_USER:$NEXUS_PASS" \
  --upload-file "./dist/release.zip" \
  "https://nexus.example.com/repository/raw-releases/myapp/${CI_COMMIT_SHA}/release.zip"

Deployer does not require this step for symlink releases. It helps when QA wants to diff exact asset trees between builds without redeploying. Treat published artefacts like test data management for pipelines — name clearly, expire deliberately, and never overwrite immutable paths.

Docker images through the same manager

Both Nexus and Artifactory run Docker registries. Configure the daemon or Kaniko to pull base images through your cache:

docker pull nexus.example.com:8082/library/php:8.4-fpm
docker tag nexus.example.com:8082/library/php:8.4-fpm php:8.4-fpm

On bandwidth-constrained hosting in Nepal, cached Docker layers alone can cut CI time by several minutes per job. That saving adds up across dozens of microservices or multi-tenant enterprise application development projects.

What security, retention, and backup policies actually matter?

A repository manager becomes a single point of failure and a high-value target. Treat it as production infrastructure from the first install — not as a side experiment on a forgotten VM.

Authentication and network placement

• Run Nexus or Artifactory behind HTTPS with a valid TLS certificate.
• Restrict admin UI access by IP or VPN; CI bots get read-only or deploy-scoped tokens.
• Disable anonymous write everywhere. Anonymous read is a trade-off — acceptable for internal LAN mirrors, risky on public subnets.
• Enable cleanup policies on proxy repos so a disk full event does not take down every pipeline.

Align credential storage with your wider approach to multi-cloud secrets management. One CI token per project beats one shared admin password in a group variable.

Retention and cleanup

Proxy caches grow until you cap them. Set age-based or size-based cleanup tasks. For hosted releases, keep the last N semver tags and purge snapshot builds after 30 days unless compliance requires longer retention.

Document what you keep. Legal-tech portals and client document systems sometimes face audit questions about third-party library versions shipped on a given date. Your repository manager's browse UI and REST API become the evidence source — export SBOMs if you adopt Nexus Lifecycle or Artifactory Xray.

Backup strategy

Back up the blob store and database together. On Nexus, that means the sonatype-work directory and embedded DB or external PostgreSQL. On Artifactory, blob storage on disk or S3 plus the PostgreSQL metadata DB. Test restores — a tarball nobody has restored is not a backup.

This sits alongside normal Ubuntu repository management for OS packages. OS mirrors and application artefact caches solve different layers of the stack. Confusing apt caching with Composer proxying leads to odd troubleshooting sessions I would prefer you skip.

Key Takeaways

• Run a repository manager so Composer, npm, and Docker pulls are cached, authenticated, and reproducible across every CI job.
• Start with proxy plus group repositories; add hosted repos only when you publish internal packages.
• Nexus OSS fits fast setups; Artifactory plus Xray fits teams that need HA and deep CVE tracking on every format.
• Wire GitLab CI through scoped tokens stored as masked variables — never commit credentials to composer.json or .npmrc.
• Schedule cleanup and test blob-store restores before disk pressure becomes a production outage.
• Commit lockfiles and use composer install plus npm ci so the manager serves exact versions, not floating semver ranges.

People Also Ask

Can Nexus or Artifactory replace Packagist and npm entirely?

No. They proxy and cache public registries; they do not replace them. Your proxy repository still resolves metadata from Packagist or registry.npmjs.org on first request. After that, builds hit local cache. If the upstream disappears, cached versions remain available — which is exactly why you run the manager.

Is Nexus OSS enough for a small Laravel team?

For many teams, yes. Nexus OSS supports Composer, npm, Docker, and Maven proxy and hosted repositories without license cost. You lose advanced firewall and lifecycle features, but you still get caching, private hosting, and RBAC on the commercial Pro tier if you upgrade later.

How does artifact management differ from GitLab Package Registry?

GitLab Package Registry integrates tightly with GitLab CI and project permissions. Nexus and Artifactory are format-agnostic hubs that serve many CI systems and many teams from one cache. Choose GitLab-native storage when you live entirely inside GitLab; choose Nexus or Artifactory when PHP, Java, Docker, and legacy pipelines must share one cache and one audit trail.

What PHP and Laravel versions work with private Composer repositories?

Composer 2.10 supports repository managers on any supported PHP version — PHP 8.2 or higher for Laravel 12, PHP 8.3 or higher for Laravel 13. The repository URL lives in composer.json; PHP runtime version does not change the integration pattern.

Ship reproducible builds with confidence

Artifact Management with Nexus and Artifactory turns fragile registry dependencies into infrastructure you control. Start with a Composer and npm proxy on Nexus OSS, connect GitLab CI with scoped tokens, commit your lockfiles, and add retention plus backups before the cache fills its first disk. If you want help wiring this into Deployer releases, Docker caching, or a multi-project GitLab pipeline, contact us or explore support and maintenance services. For proof this pipeline model runs in production, see the Translation Nepal portfolio entry and related sister-site deployments. Validate JSON config before paste-deploying with the JSON formatter tool, and read more on Terraform state management when infrastructure and application artefacts share the same ops mindset. Visit the home page or about page for broader context on how these systems are operated in production.