Nexus Repository Manager Guide

By Kokil Thapa | Last reviewed: September 2026

Your builds fail when npmjs.com or repo.maven.apache.org blips for thirty seconds. A solid Nexus Repository Manager guide fixes that by giving your team one internal hub for Composer, npm, Maven, and Docker artifacts. On production Laravel and eCommerce projects, I've seen slow or blocked upstream pulls waste hours every month. Nexus sits between developers, CI runners, and public registries so dependencies download once and reuse locally. This page walks through install, repository design, client config, security, and the mistakes that break real pipelines.

What is Nexus Repository Manager and why should your team use it?

Nexus Repository Manager is Sonatype's binary artifact hub. It stores your own packages and mirrors public registries. Think of it as an internal CDN for dependencies. Your enterprise application stack stops treating npm, Packagist, and Maven Central as single points of failure.

Three repository types drive every Nexus design:

• Hosted — stores artifacts you publish (internal Composer packages, release JARs, private npm scopes).
• Proxy — caches upstream content from Packagist, npmjs, Maven Central, or Docker Hub on first request.
• Group — merges hosted and proxy repos behind one URL clients actually use.

On client projects where GitLab CI runs Composer and npm on every push, a local proxy cut install time from minutes to seconds after the first build. That pattern mirrors what I use on sister sites sharing a Ubuntu repository management workflow with Deployer 7 releases.

Nexus 3 (current Sonatype line) supports Maven, npm, NuGet, PyPI, RubyGems, Docker, Helm, and more. For PHP teams on Laravel 12 or 13 with Composer 2.10, a Composer proxy plus hosted repo is usually enough. Node 26 LTS front-end builds benefit the same way from an npm group repository.

How do you install Nexus Repository Manager on Ubuntu?

Run Nexus on a dedicated VM with fast disk and enough RAM. Sonatype recommends 4 GB minimum for small teams; 8 GB is safer once Docker and npm proxies fill the blob store. I've provisioned similar hosts using Ansible playbooks for PHP server provisioning on Ubuntu 22 or 24.

Download and create the nexus user

1. Create a system user with a home directory under /opt/nexus.
2. Download the latest Nexus 3 OSS tarball from Sonatype's official download page.
3. Extract to /opt/nexus and point a nexus symlink at the versioned folder.
4. Set ownership: chown -R nexus:nexus /opt/nexus /opt/sonatype-work.

sudo useradd --system --home-dir /opt/nexus --shell /bin/bash nexus
cd /opt
sudo wget https://download.sonatype.com/nexus/3/latest-unix.tar.gz
sudo tar xzf latest-unix.tar.gz
sudo ln -sfn nexus-3.* nexus
sudo mkdir -p /opt/sonatype-work
sudo chown -R nexus:nexus /opt/nexus /opt/sonatype-work

Systemd service and reverse proxy

Nexus ships a sample systemd unit. Set run_as_user=nexus in nexus.vmoptions. Limit JVM heap in the same file — typically -Xms2g -Xmx2g on an 8 GB box. Enable and start the service, then put Nginx or Apache in front for TLS.

# /etc/systemd/system/nexus.service
[Unit]
Description=Nexus Repository Manager
After=network.target

[Service]
Type=forking
LimitNOFILE=65536
ExecStart=/opt/nexus/bin/nexus start
ExecStop=/opt/nexus/bin/nexus stop
User=nexus
Restart=on-abort

[Install]
WantedBy=multi-user.target

Default port is 8081. Initial admin password lives in /opt/sonatype-work/nexus3/admin.password. Change it on first login. For production, terminate TLS at Nginx and restrict port 8081 to localhost. Patterns overlap with Kubernetes ingress and TLS with cert-manager when Nexus runs inside a cluster instead of a bare VM.

Budget roughly Rs 3,000–8,000/month (~USD 22–60) for a small VPS with 4–8 GB RAM in Nepal or regional cloud zones. Disk grows with cached artifacts — plan 50 GB minimum, more if you proxy Docker layers.

How do you configure Maven, npm, and Composer repositories in Nexus?

Repository design matters more than any single setting. A common mistake is pointing clients directly at a proxy repo. Use a group that lists hosted first, then proxy. Nexus searches members in order and returns the first match.

Composer and PHP / Laravel projects

In the Nexus UI, go to Settings → Repositories → Create repository. Add these three:

1. composer-hosted — type hosted, for your private packages.
2. composer-proxy — type proxy, remote URL https://repo.packagist.org.
3. composer-group — type group, members: hosted, then proxy.

Point project composer.json repositories at the group URL:

{
  "repositories": [
    {
      "type": "composer",
      "url": "https://nexus.example.com/repository/composer-group/"
    }
  ],
  "config": {
    "secure-http": true
  }
}

Authenticate with HTTP basic auth or a user token. Store credentials in CI variables, not in git. See manage secrets with AWS Secrets Manager for one pattern; GitLab masked variables work too.

npm for Vite 8.x and Node 26 LTS builds

Create npm hosted, npm proxy (remote https://registry.npmjs.org), and npm group repos. Configure the client:

npm config set registry https://nexus.example.com/repository/npm-group/
npm login --registry=https://nexus.example.com/repository/npm-group/

For scoped packages you publish internally, use npm publish --registry=https://nexus.example.com/repository/npm-hosted/. CI pipelines on projects like Adventure Third Pole Trek repeat the same registry URL in every job so cache hits stay predictable.

Maven for Java sidecars and Android builds

Java teams use the same trio: maven-releases (hosted), maven-central (proxy), maven-public (group). Publish with mvn deploy aimed at the hosted releases URL. Consumer pom.xml or settings.xml references the group.

<settings>
  <mirrors>
    <mirror>
      <id>nexus</id>
      <mirrorOf>*</mirrorOf>
      <url>https://nexus.example.com/repository/maven-public/</url>
    </mirror>
  </mirrors>
</settings>

Do not confuse this Maven mirror with the Laravel repository pattern for Eloquent. Same word, different layer — Nexus handles binary packages, not database access code.

How do you secure Nexus and integrate it with CI/CD?

An open Nexus instance on the public internet is a liability. Attackers have scanned for anonymous write access on misconfigured registries. Lock it down before you cache anything sensitive.

RBAC, anonymous access, and cleanup

Disable anonymous access unless you have a deliberate read-only public mirror behind a firewall. Create roles per team: npm-read, composer-deploy, docker-push. Assign users or CI tokens to those roles only.

• Enable Cleanup policies on proxy repos so old snapshot caches do not fill the disk.
• Turn on Blob store monitoring — alert when free space drops below 20%.
• Export config regularly with the REST API or UI backup.
• Run Nexus behind VPN or IP allowlists if the team is small and mostly in one office.

For credential rotation, treat Nexus tokens like database passwords. I've seen stale CI variables cause confusing 401 errors that look like package version conflicts. A quick test with JSON formatter on API error responses saves debug time.

GitLab CI example for Laravel

Cache Composer and npm through Nexus in every pipeline stage that installs dependencies:

variables:
  COMPOSER_AUTH: '{"http-basic":{"nexus.example.com":{"username":"ci","password":"$NEXUS_CI_TOKEN"}}}'
  NPM_CONFIG_REGISTRY: "https://nexus.example.com/repository/npm-group/"

composer_install:
  script:
    - composer install --no-dev --prefer-dist --no-interaction
  cache:
    key: composer-$CI_COMMIT_REF_SLUG
    paths:
      - vendor/

npm_build:
  script:
    - npm ci
    - npm run build
  cache:
    key: npm-$CI_COMMIT_REF_SLUG
    paths:
      - node_modules/

Pair this with AI code review in your CI pipeline only after dependency installs are stable. Broken registry auth wastes every downstream job. Our support and maintenance service often starts with fixing exactly these pipeline fragility issues on long-running client apps.

Nexus Repository Manager vs JFrog Artifactory: which should you choose?

Both products solve artifact management. Your choice depends on budget, formats, and ops capacity. Nexus OSS is free for core features; Artifactory's full feature set sits behind paid tiers.

For a deeper side-by-side, read our artifact management with Nexus and Artifactory comparison. Most Nepal agencies I work with pick Nexus OSS on a single Ubuntu box until traffic demands clustering. That matches the boring-infrastructure philosophy on Linux system administration engagements — prove value before buying enterprise licenses.

What are common Nexus Repository Manager problems and how do you fix them?

Production Nexus issues cluster around disk, permissions, and misconfigured URLs. These fixes cover ninety percent of tickets I've seen.

Disk full and slow blob store

Symptom: HTTP 507 or UI warnings. Run cleanup policies on proxy repositories. Compact blob stores during a maintenance window from Administration → Tasks. Add volume before compact fails mid-run.

401 Unauthorized in CI but local works

Compare COMPOSER_AUTH or npm tokens between laptop and pipeline. GitLab protected variables do not expose to unprotected branches. Confirm the CI user has nx-repository-view-* privileges on the group repo, not only the hosted repo.

SSL and reverse proxy errors

Nexus behind Nginx needs correct X-Forwarded-* headers. Set nexus-context-path if serving under a subpath. Mixed HTTP/HTTPS in repository URLs causes redirect loops in Composer.

Wrong repository pattern in application code

If developers mention "repository" bugs in Laravel, confirm they mean Composer/Nexus — not Eloquent data access. The naming collision trips up junior devs. Point them to repository pattern anti-patterns for the application-layer topic, not this artifact manager.

Sonatype publishes task schedules and health check endpoints in the Repository Manager 3 documentation. Bookmark the REST API section for scripting repository exports during disaster-recovery drills.

Key Takeaways

• Install Nexus 3 on Ubuntu with a dedicated nexus user, systemd unit, and TLS reverse proxy — never expose port 8081 raw to the internet.
• Create hosted + proxy + group repos for each format; point Composer, npm, and Maven clients only at the group URL.
• Disable anonymous write, use CI tokens with least privilege, and schedule cleanup policies before disk fills.
• Wire GitLab CI variables (COMPOSER_AUTH, NPM_CONFIG_REGISTRY) so laptop and pipeline share the same cached upstream.
• Compare Nexus OSS vs Artifactory on license, HA needs, and team size before paying for enterprise features.
• When builds fail, check auth tokens first, upstream second, disk third — that order matches most real incidents.

People Also Ask

Is Nexus Repository Manager free?

Nexus Repository Manager OSS is free and covers Maven, npm, Docker, and Composer for most small and medium teams. Sonatype sells Pro and Enterprise tiers with advanced security scanning, high-availability clustering, and support SLAs. Start with OSS on a single node until you outgrow it.

Can Nexus replace Packagist or npmjs entirely?

Not for public open-source consumption worldwide. Nexus proxies and caches those upstream registries for your organisation. You still need internet on first fetch. After cache warm-up, builds survive short upstream outages because artifacts live in your blob store.

How much disk space does Nexus need?

Plan 50 GB minimum for a PHP and Node shop with moderate CI volume. Docker proxy repos grow fastest. Monitor blob store usage weekly and set cleanup policies to drop unused cache older than 30–90 days depending on compliance needs.

Does Nexus work with Laravel and WordPress projects?

Yes. Laravel apps use Composer through a Composer proxy/group. WordPress plugins and themes that ship Node build steps benefit from an npm group repo the same way. The application stack does not change — only registry URLs and CI credentials do.

Build faster pipelines with a local artifact hub

This Nexus Repository Manager guide gives you a repeatable path from bare Ubuntu install to cached Composer and npm pulls in GitLab CI. The payoff is fewer red builds, predictable deploys, and less dependence on public registry uptime. If you want help standing up Nexus alongside Deployer releases, PHP-FPM tuning, or a full custom software development pipeline, review our Notary Kathmandu sister-site DevOps work or browse more guides on the blog. Contact us to plan registry setup, CI hardening, or migration from a flaky direct-upstream workflow.