Docs & Changelog

Nexspence manages Maven, npm, PyPI, Docker, OCI artifacts, Go modules, NuGet, Cargo, Helm, Apt, Yum/RPM, Conan, Raw, Conda and Terraform packages from a single self-hosted registry. Repositories can be Hosted (your published artifacts), Proxy (cached remote registries) or Group (multiple repositories under one URL).

This documentation covers Quick Start, Installation, Repositories, per-format guides, Browse & Search, Users, Roles & Privileges (RBAC), Cleanup policies, Webhooks, Migration from Nexus, Monitoring, Build Promotion, Replication, and the full REST API reference.

Get started in under two minutes with Docker Compose: download the latest release, set a strong admin_password and jwt_secret in config.yaml, then run docker compose up -d and open the UI at http://localhost:8081.

Every key can be overridden via env var: NEXSPENCE_<SECTION>_<KEY> (uppercase, underscore-separated).

Artifact storage is never rewritten by an upgrade: local blob directories and S3 buckets are read and written in the same layout across releases. Skipping versions is supported — migrations from every intermediate release run in order. Read the release notes for each version you skip; anything needing a manual step is called out there.

The running version also appears under System Admin → Info and at the bottom of the sidebar. The startup log line migrations OK confirms the schema is current; a failure there stops the server before it serves a single request, so a silent half-migrated state is not a state you can reach.

Fresh installs and S3 blob stores are unaffected. After the chown, start the stack normally with docker compose up -d.

Add Nexspence as a mirror in ~/.m2/settings.xml to route all dependency downloads through your proxy repository.

The scanner is probed with <bin> --version, which answers three questions at once: is the file there, will it run here, and which version is it. The answer is one of four states, visible in Admin → Security → CVE Scan, at GET /api/v1/security/scanner, and in one log record at startup.

A scan requested while the scanner is unavailable is refused with that sentence instead of failing obscurely, and automatic scan-on-upload skips image components rather than filling the history with errors. Once scanning is enabled the binary probe re-runs at most once a minute, so supplying or replacing the binary is picked up without a restart — configuration changes, including the switch itself, are read only at startup.

By default Trivy pulls it from ghcr.io on first use, which is why the first scan takes a minute or two. In an air-gapped network, mirror it into a nexspence repository and point Trivy at the mirror. Mirror both databases: the Java one is fetched separately the first time an image containing Java artifacts is scanned, and an unmirrored one dials ghcr.io and fails.

Declare the provider, point it at your Nexspence server, and define resources. Run terraform init, then terraform apply.

Authenticate with an nxs_* API token (preferred) or username + password. Set credentials in the provider block or via environment variables.

Define local or S3-compatible blob stores. The S3 endpoint is dialed by the Nexspence server, so use an address the server can reach (e.g. an in-network hostname) — not your workstation's localhost.

To hack on the provider itself, point Terraform at your locally built binary with a dev override in ~/.terraformrc.

The dev Docker Compose stack sets NEXSPENCE_AUTH_ALLOW_INSECURE_DEFAULTS=true so the quick-start still boots out of the box — never use that override in production.

Never commit real secrets to config.yaml. Inject them through environment variables instead — they override the matching config keys at startup.

Opt-in per-IP / per-user throttling. Disabled by default — enable it with auth.rate_limit_enabled: true and tune rate_limit_rps / rate_limit_burst.

Any non-admin user can rotate their own password without an administrator. Changing the password bumps the JWT cutoff, so existing sessions are invalidated.