Nexus Nginx TLS on docker

Nexus + Nginx TLS on docker.md

Prepare the following filestructure:

/nginx +-- nginx.conf # part of this gist
       +-- /certs +-- Nexus.crt.pem # "TRUSTED certificate"
                  +-- Nexus.key.pem

Run the following commands:

docker network create nexus
docker volume create --name nexus-data
docker run -d --network nexus --restart always -v nexus-data:/nexus-data --name nexus sonatype/nexus3
docker run -d --network nexus --restart always -p 80:80 -p 443:443 -p 3000-3010:3000-3010 -v ~/nexus/:/etc/nginx/ --name nginx nginx

nginx.conf

user  nginx;
worker_processes  auto;
worker_rlimit_nofile 8192;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    # docker DNS
    resolver 127.0.0.11;
    
    #include       /etc/nginx/mime.types;
    #default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  /var/log/nginx/access.log  main;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256";
    ssl_prefer_server_ciphers on;

    server {
        # Docker HTTPS
        listen 3000-3010 ssl;
        listen [::]:3000-3010 ssl;

        error_page 497 https://$host:$server_port$request_uri;
        
        ssl_certificate /etc/nginx/certs/Nexus.crt.pem;
        ssl_certificate_key /etc/nginx/certs/Nexus.key.pem;

        client_max_body_size 20G;
        
        
        location / {
            proxy_pass http://nexus:$server_port;
            
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
            proxy_set_header X-Ssl on;
        }
    }
    
    #Point http requests to https
    server {
        listen 80;
        listen [::]:80;
        server_tokens off;
        return 301 https://$host$request_uri;
    }
    
    server {
        # WebUI
        listen 443 ssl;
        listen [::]:443 ssl;

        error_page 497 https://$host:$server_port$request_uri;
        
        ssl_certificate /etc/nginx/certs/Nexus.crt.pem;
        ssl_certificate_key /etc/nginx/certs/Nexus.key.pem;
        
        location / {
            proxy_pass http://nexus:8081;
            
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_set_header X-NginX-Proxy true;
            proxy_set_header X-Ssl on;
        }
    }

    #sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    #include /etc/nginx/conf.d/*.conf;
}