Nexus Repository OSS on an Offshore VPS

Every CI build that pulls a hundred npm packages from registry.npmjs.org or a couple dozen Maven JARs from Maven Central counts as a public request. Most public registries do not rate-limit aggressively, but they all log source IPs, and corporate or sensitive projects may not want their full dependency graph correlated to their build infrastructure IP range. A Nexus proxy on your own VPS becomes the only IP that talks to public registries, and your CI nodes all pull through Nexus over a private network or a VPN. Caching is the second big win. The first build that needs lodash, react, or springboot-starter-web fetches it from the public registry and caches it locally. Every subsequent build pulls from local SSD at gigabit speeds - a typical CI run drops from 60 seconds of npm install to 5 to 10 seconds once the cache is warm. For Maven builds with hundreds of transitive deps, the saving is even more dramatic. Nexus also supports hosted repositories where you publish your own artifacts. This is critical if you build closed-source libraries that should not be on public registries. Combine hosted repositories with RBAC and you get a private registry for internal teams without paying for a SaaS like Artifactory Cloud or Cloudsmith.

Nexus is a Java application that runs on the JVM. Default heap is 2.7 GB, which is fine for small teams but tight for teams with multiple format proxies and many concurrent CI runs. For a 5 to 20 person team using 3 to 5 repository formats, allocate 6 to 8 GB RAM on the VPS and tune the JVM heap to 4 GB via the `nexus.vmoptions` file. CPU is rarely a bottleneck; 2 to 4 vCPU is enough. Disk is the big variable. Maven and Docker caches grow steadily and never shrink unless you configure cleanup policies. A team that builds in JVM heavily can easily accumulate 100 to 300 GB of cached artifacts over a year. For Docker proxies, blobs are deduplicated but still grow with image diversity. Plan on at least 200 GB SSD for a small team, 500 GB to 1 TB for a larger one. Nexus supports blob store on local disk or S3-compatible object storage if you want to decouple compute and storage. Network throughput matters during the first warm-up of any new dependency tree and during full mirror syncs. Once warm, internal CI traffic is gigabit local. AnubizHost 1 Gbps unmetered uplinks let your CI fleet hit Nexus full speed without throttling, and Nexus pulls from public registries without bandwidth caps slowing the cache warmup.

Install OpenJDK 17 (the Java version Nexus 3 supports): `apt install -y openjdk-17-jre-headless`. Create a dedicated user and download Nexus: `useradd -r nexus && cd /opt && wget https://download.sonatype.com/nexus/3/latest-unix.tar.gz && tar xzf latest-unix.tar.gz && mv nexus-3.* nexus && mv sonatype-work nexus-data && chown -R nexus:nexus nexus nexus-data`. Edit `/opt/nexus/bin/nexus.rc` and set `run_as_user="nexus"`. Edit `/opt/nexus/etc/nexus-default.properties` to set `application-port=8081` and `application-host=127.0.0.1` (bind to localhost; we will reverse-proxy with TLS). Optionally tune the JVM at `/opt/nexus/bin/nexus.vmoptions` - bump `-Xmx` and `-XX:MaxDirectMemorySize` based on your VPS RAM. Create a systemd unit at `/etc/systemd/system/nexus.service` that runs `/opt/nexus/bin/nexus start` as the nexus user. Enable and start: `systemctl daemon-reload && systemctl enable --now nexus`. First start takes 60 to 120 seconds. Read the initial admin password: `cat /opt/sonatype-work/nexus3/admin.password`. Put Caddy or Nginx with Let's Encrypt in front, login at the resulting URL, change the admin password immediately, disable anonymous access, then create proxy repositories pointing at the upstream you actually use (Maven Central, registry.npmjs.org, pypi.org, docker.io, etc).