# Running the Sonatype Platform Behind NGINX Using Docker

**February 28, 2018**  
By [Curtis Yanko](/content/blog/author/curtis-yanko/index.html)

7 minute read time

I believe that reasonably smart people learn fastest from working examples. It's relatively easy to make small changes to a working example and learn through experimentation.

Hopefully, this project can help jumpstart your understanding of Docker and containers, along with how to use our provisioning API and the new nexus-cli tool.

In previous posts, we've explored using Docker Compose with the official Sonatype containers. [Part 1](/content/blog/docker-compose-for-nexus-platform/index.html) was an intro to Docker and our containers while [Part 2](/content/blog/docker-compose-for-nexus-platform-part2/index.html) built upon that by showing how do a custom build to add your configuration to a stock container.

In this post, we'll further build upon that with:

- Offloading SSL to NGINX for both Sonatype IQ Server and [Sonatype Nexus Repository](/content/products/sonatype-nexus-repository/index.html)
- Configuring the NGINX routes
- Using the provisioning API to configure our new servers to:
  - create a blobstore
  - create the docker repositories and group
  - install the IQ Server license and import a set of policies

For this work I've created a new folder in my GitHub demo-iq-server project. Let's start the walkthrough with the demo-setup.sh script.

> `#!/usr/bin/env bash`
> 
> `# Creates directories to be mounted to containers as volumes`
> 
> `mkdir ~/iq-data ~/nexus-data`
> 
> `# Stands up test environment and builds nginx container to put our config in`
> 
> `docker-compose up -d --build`
> 
> `#wait`
> 
> `until curl --fail --insecure http://localhost:8081; do`
> 
> `   sleep 5`
> 
> `done`
> 
> `#import license and policies to IQ server`
> 
> `./iq-server/config-iq.sh`
> 
> `#Create Docker repos and group`
> 
> `cd nexus-repository`
> 
> `./create.sh blobs.json`
> 
> `./run.sh myBlobs`
> 
> `./create.sh docker.json`
> 
> `./run.sh Docker`

It starts off just like before by making the folders we'll need for persistent volumes and then calling docker-compose with the 'build' flag. After waiting for the Sonatype IQ Server to respond, we move on to the provisioning scripts. To understand how to bring this up, we need to look at the docker-compose.yml file:

```
version: '3'

services:
  nginx-proxy:
    build: ./nginx
    ports:
      - '443:443'
      - '5000:5000'
      - '18443:18443'
    links:
      - nexus
      - iq-server
    command: [ nginx, '-g', 'daemon off;' ]

nexus:
    volumes:
      - ~/nexus-data:/nexus-data
    ports:
      - "8081:8081"
    image: sonatype/nexus3:3.8.0
    links:
      - iq-server
    container_name: nexus

iq-server:
    build: ./iq-server
    volumes:
      - ~/iq-data:/sonatype-work
    ports:
      - "8070:8070"
      - "8071:8071"
    image: sonatype/nexus-iq-server:1.44.0
    container_name: iq-server
```

The NGINX proxy handles the inbound traffic by exposing 443 for HTTPS and routing traffic to the iq-server and Sonatype Nexus Repository. The routing is configured in the nginx.conf file:

```
http {
    proxy_send_timeout 120;
    proxy_read_timeout 300;
    proxy_buffering off;
    keepalive_timeout 5 5;
    tcp_nodelay on;

ssl on;
    ssl_certificate /etc/nginx/external/cert.pem;
    ssl_certificate_key /etc/nginx/external/key.pem;

client_max_body_size 1G;

server {
        listen 443;
        server_name nexus;

location / {
            proxy_pass http://nexus:8081/;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

server {
        listen 443;
        server_name iq-server;

location / {
            proxy_pass http://iq-server:8070/;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}
```

When we run the demo-setup.sh script, it builds the NGINX container to include our configuration. We also need to configure Sonatype Nexus Repository to set up Docker registries and import a set of policies. Let’s look at those provisioning scripts:

`#!/bin/bash`

`#Note: defaults creds are baked in so this will work on a fresh instance`

```bash
nexus() {
    java -jar nexus-cli-1.0-SNAPSHOT-shaded.jar \
        -s http://localhost:8070 $@
}
```  
We can see this is a 'wrapper' script for the nexus-cli JAR file. Importing the IQ server license and applying policies are done using this wrapper.

When configuring Sonatype Nexus Repository, I found the [scripting](https://github.com/sonatype/nexus-book-examples/tree/nexus-3.x/scripting) section of the [nexus-book-examples](https://github.com/sonatype/nexus-book-examples) to be helpful.

So, here's the process in the demo-setup.sh:

```bash
#Create Docker repos and group

cd nexus-repository

./create.sh blobs.json

./run.sh myBlobs

./create.sh docker.json

./run.sh Docker
```

I wanted a separate blobstore for Docker, so I created blobs.json for that definition and the run command executes it. I also define the necessary repositories in the docker.json file.

Hopefully, this project can help folks by being a working example to learn from. This journey into managing my apps as containers has been interesting and I'm excited about the ease of starting from scratch it provides.

Written by **Curtis Yanko**  
Curtis Yanko is a Sr Principal Architect at Sonatype and a DevOps coach/evangelist. When he isn’t working with customers and partners on how to build security and governance into modern CI/CD pipelines he can be found raising service dogs or out playing ultimate frisbee during his lunch hour.