Effortlessly Deploy Sonatype Platform with NGINX and Docker

Running the Sonatype Platform Behind NGINX Using Docker

February 28, 2018
By Curtis Yanko

7 minute read time

I believe that reasonably smart people learn fastest from working examples. It's relatively easy to make small changes to a working example and learn through experimentation.

Hopefully, this project can help jumpstart your understanding of Docker and containers, along with how to use our provisioning API and the new nexus-cli tool.

In previous posts, we've explored using Docker Compose with the official Sonatype containers. Part 1 was an intro to Docker and our containers while Part 2 built upon that by showing how do a custom build to add your configuration to a stock container.

In this post, we'll further build upon that with:

For this work I've created a new folder in my GitHub demo-iq-server project. Let's start the walkthrough with the demo-setup.sh script.

#!/usr/bin/env bash

# Creates directories to be mounted to containers as volumes

mkdir ~/iq-data ~/nexus-data

# Stands up test environment and builds nginx container to put our config in

docker-compose up -d --build

#wait

until curl --fail --insecure http://localhost:8081; do

sleep 5

done

#import license and policies to IQ server

./iq-server/config-iq.sh

#Create Docker repos and group

cd nexus-repository

./create.sh blobs.json

./run.sh myBlobs

./create.sh docker.json

./run.sh Docker

It starts off just like before by making the folders we'll need for persistent volumes and then calling docker-compose with the 'build' flag. After waiting for the Sonatype IQ Server to respond, we move on to the provisioning scripts. To understand how to bring this up, we need to look at the docker-compose.yml file:

version: '3'

services:
  nginx-proxy:
    build: ./nginx
    ports:
      - '443:443'
      - '5000:5000'
      - '18443:18443'
    links:
      - nexus
      - iq-server
    command: [ nginx, '-g', 'daemon off;' ]

nexus:
    volumes:
      - ~/nexus-data:/nexus-data
    ports:
      - "8081:8081"
    image: sonatype/nexus3:3.8.0
    links:
      - iq-server
    container_name: nexus

iq-server:
    build: ./iq-server
    volumes:
      - ~/iq-data:/sonatype-work
    ports:
      - "8070:8070"
      - "8071:8071"
    image: sonatype/nexus-iq-server:1.44.0
    container_name: iq-server

The NGINX proxy handles the inbound traffic by exposing 443 for HTTPS and routing traffic to the iq-server and Sonatype Nexus Repository. The routing is configured in the nginx.conf file:

http {
    proxy_send_timeout 120;
    proxy_read_timeout 300;
    proxy_buffering off;
    keepalive_timeout 5 5;
    tcp_nodelay on;

ssl on;
    ssl_certificate /etc/nginx/external/cert.pem;
    ssl_certificate_key /etc/nginx/external/key.pem;

client_max_body_size 1G;

server {
        listen 443;
        server_name nexus;

location / {
            proxy_pass http://nexus:8081/;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

server {
        listen 443;
        server_name iq-server;

location / {
            proxy_pass http://iq-server:8070/;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

When we run the demo-setup.sh script, it builds the NGINX container to include our configuration. We also need to configure Sonatype Nexus Repository to set up Docker registries and import a set of policies. Let’s look at those provisioning scripts:

#!/bin/bash

#Note: defaults creds are baked in so this will work on a fresh instance

nexus() {
    java -jar nexus-cli-1.0-SNAPSHOT-shaded.jar \
        -s http://localhost:8070 $@
}

We can see this is a 'wrapper' script for the nexus-cli JAR file. Importing the IQ server license and applying policies are done using this wrapper.

When configuring Sonatype Nexus Repository, I found the scripting section of the nexus-book-examples to be helpful.

So, here's the process in the demo-setup.sh:

#Create Docker repos and group

cd nexus-repository

./create.sh blobs.json

./run.sh myBlobs

./create.sh docker.json

./run.sh Docker

I wanted a separate blobstore for Docker, so I created blobs.json for that definition and the run command executes it. I also define the necessary repositories in the docker.json file.

Hopefully, this project can help folks by being a working example to learn from. This journey into managing my apps as containers has been interesting and I'm excited about the ease of starting from scratch it provides.

Written by Curtis Yanko
Curtis Yanko is a Sr Principal Architect at Sonatype and a DevOps coach/evangelist. When he isn’t working with customers and partners on how to build security and governance into modern CI/CD pipelines he can be found raising service dogs or out playing ultimate frisbee during his lunch hour.