Nginx Reverse Proxy for Nexus Docker Registries

README.md

Overview

This is a solution of a common problem with Nexus Docker repositories. The administrator has to expose port for "pull", another port for "push", other ports for each hosted repository. This solution is about leveraging Nginx reverse proxy to avoid using these ports.

How it works ?

Given :

• Nexus hostname is "nexus.example.com"
• Nexus web port is 8081
• A hosted repository is named "docker-hosted"
• A group repository is named "docker-group"
• Your nginx (with the nginx.conf of this gist) will run for example under cregistry.example.com

The following Nginx configuration file is for a reverse proxy without the need to expose connector ports from nexus :

• docker pull cregistry.example.com/myimage lets Nginx forward the request to "docker-group"
• docker push cregistry.example.com/myimage lets Nginx forward the request to "docker-hosted"

Notes

• If you have more than one hosted repository, create another Nginx reverse proxy for it, then aggregate them using a parent Nginx reverse proxy that forwards the request according to certain criteria (.i.e: Host header).

• All Nexus repositories must have consistent configuration of authentication: Either all require authentication, or all don't.

• If TLS is enabled with Nexus, change proxy_set_header X-Forwarded-Proto "http"; by proxy_set_header X-Forwarded-Proto "https";

docker-compose.yaml

version: "3"

services:
  web:
    image: nginx:1.15
    hostname: cregistry.example.com
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
    ports:
      - "80:80"
  nexus:
    image: sonatype/nexus3
    hostname: nexus.example.com
    volumes:
      - "nexus-data:/nexus-data"
    ports:
      - "8081:8081"
 
volumes:
  nexus-data: {}

nginx.conf

events {
  worker_connections  1024;
}

http {
  
  proxy_send_timeout 120;
  proxy_read_timeout 300;
  proxy_buffering    off;
  keepalive_timeout  5 5;
  tcp_nodelay        on;
  # disable any limits to avoid HTTP 413 for large image uploads
  client_max_body_size 0;


  server {
      listen   *:80;

      location ~ ^/(v1|v2)/[^/]+/?[^/]+/blobs/ {
          if ($request_method ~* (POST|PUT|DELETE|PATCH|HEAD) ) {
              rewrite ^/(.*)$ /repository/docker-hosted/$1 last;
          }
          rewrite ^/(.*)$ /repository/docker-group/$1 last;
      }

      location ~ ^/(v1|v2)/ {
          if ($request_method ~* (POST|PUT|DELETE|PATCH) ) {
              rewrite ^/(.*)$ /repository/docker-hosted/$1 last;
          }
          rewrite ^/(.*)$ /repository/docker-group/$1 last;
      }

      location / {
          proxy_pass http://nexus.example.com:8081/;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto "http";
      }
  }
}