OrientDB to Self-Hosted PostgreSQL Migration

OrientDB to Self-Hosted PostgreSQL Migration

Use this section to migrate a legacy self-hosted OrientDB instance to a self-hosted PostgreSQL instance.

Pre-Migration Setup

This section explains how to prepare the source instance, target instance, and migrator before migration.

Source Instance Configuration

To migrate encrypted secrets such as passwords, tokens, and credentials, configure a cipher password on the source instance before you start the migration.

The following secrets require a cipher password:

Category Secrets
Blob Store S3 secret access keys, Azure storage account keys, Google Cloud service account keys
Repository HTTP proxy passwords, remote repository credentials, Docker registry passwords, APT and Yum signing keypairs and passphrases
System LDAP bind passwords, SAML private keys, email server passwords
User Authentication API keys such as NuGet and npm, and user tokens

Take the following steps to generate a cipher password:

  1. Generate a cipher password with a minimum of 24 characters.
   openssl rand -base64 32
  1. Add the cipher password to $NEXUS_DATA/etc/nexus.properties on the source instance.
   nexus.migrator.cipher.password=<your-generated-password>
  1. Restart the source OrientDB instance.

Warning

If you do not configure a cipher password, the migrator does not migrate sensitive data such as passwords, tokens, or S3 credentials. You must then reconfigure those values manually on the target instance.

To migrate local users, you may also need to add the nexus.user.configuration.source.enabled=true entry to $NEXUS_DATA/etc/nexus.properties on the source instance.

Target Instance Configuration

Use this section to prepare the PostgreSQL target instance.

  1. Enable user configuration import in $NEXUS_DATA/etc/nexus.properties
   nexus.user.configuration.source.enabled=true
  1. Create blob stores on the target with names that match the source blob stores.
  2. Delete all default repositories created during initial Nexus startup, such as maven-central, maven-releases, maven-snapshots, and nuget-hosted.
  3. When the target instance is Nexus 3.92 and above, allow private networks for migrating proxy repositories of local instances by setting nexus.proxy.allowPrivateNetworks=true
  4. Restart the target Nexus instance.

Important

Pre-created repositories are not overridden during migration. Leaving them in place can cause configuration inconsistencies and repository ID mismatches.

Migrator Configuration

Configure the migrator cipher password to match the source instance.

config set target-cipher-password <same-password-as-source>

What Gets Migrated

This section describes which configuration items are included in an OrientDB to PostgreSQL migration.

Configuration Or Data Type Status Notes
Repositories Yes All supported formats
Blob stores Yes File and S3 (S3 requires cipher)
Proprietary repositories Yes
Content Selectors Yes
Cleanup policies Yes
Routing Rules Yes
Privileges Yes
Roles Yes
LDAP role mappings Yes LDAP connection configured manually
Users (local) Yes
User passwords Yes Requires cipher
User tokens/API keys Yes Requires cipher
SSL/TLS certificates Yes Requires cipher
Email configuration Yes
IQ Server configuration Yes
Logging overrides Yes
Capabilities Yes
Scheduled Tasks Yes

What Does Not Get Migrated

Use this section to understand which data is intentionally excluded.

Data Reason
Format-specific metadata files Automatically regenerated on target
Maven metadata.xml Regenerated
APT Packages or Release files Regenerated
Yum repodata (repomd.xml, primary.xml) Regenerated
Helm index files Regenerated
RubyGems specifications Regenerated
OrientDB-specific tasks Not compatible with PostgreSQL (filtered automatically)
Audit logs Remain on source instance, archive separately if needed
External role memberships LDAP/SAML/Crowd users must re-authenticate after migration

Known Limitations

Use this section to understand the limits of the OrientDB to PostgreSQL migration path.

Limitation Details
LDAP connection Not migrated. Configure manually on target. LDAP role mappings ARE migrated.
Realms Not migrated. Configure manually on target.
Bower repositories Not migrated. Bower format is deprecated.
GitLFS content Not migrated. Configuration is exported, content must be re-pushed.
H2 targets Not supported. Use PostgreSQL.