Ansible Role: Nexus 3 OSS

This role helps you install and set up Nexus Repository Manager OSS version 3.x on CentOS/RHEL.

Most settings can be changed by running the role again, except for the blobstores settings, which cannot be changed.

Requirements

• Tested on CentOS 7 and Ubuntu 16.04 (Xenial)
• Oracle Java 8 (required)
• Apache HTTPD (optional, used for setting up an SSL reverse-proxy)

(Refer to the Dependencies section below for relevant roles available on Galaxy)

Role Variables

Here are some Ansible variables with their default values (check default/main.yml):

• nexus_version: '3.1.0-04'
• nexus_timezone: 'UTC'
• nexus_package: "nexus-{{ nexus_version }}-unix.tar.gz"

nexus_version is the version of Nexus to install. You can find available versions at Sonatype's download page. nexus_timezone is used for time-related settings.

• nexus_download_dir: '/tmp'

The directory where Nexus package will be downloaded on the target machine.

• nexus_default_port: 8081
• nexus_default_context_path: '/'

The port and context path for the Nexus java process. Include the trailing slash on nexus_default_context_path, e.g., nexus_default_context_path: '/nexus/'.

• nexus_os_group: 'nexus'
• nexus_os_user: 'nexus'

User and group names for Nexus files; these will be created if they don't exist.

• nexus_installation_dir: '/opt'
• nexus_data_dir: '/var/nexus'
• nexus_tmp_dir: '/tmp/nexus'

These directories store the installed files and configuration data. Note: You can set custom paths for blobstores outside of nexus_data_dir.

• nexus_admin_password: 'changeme'

The password for the 'admin' account. Note: Changing this password after the initial setup is not currently supported by this role.

• nexus_anonymous_access: false

Enable anonymous access to Nexus.

• public_hostname: 'nexus.vm'

The domain name through which users can access the Nexus instance.

• nexus_branding_header: ""
• nexus_branding_footer: "Last provisioned {{ ansible_date_time.iso8601 }}"

Custom branding for header and footer, which can include HTML.

• httpd_setup_enable: false
• httpd_ssl_certificate_file: 'files/nexus.vm.crt'
• httpd_ssl_certificate_key_file: 'files/nexus.vm.key'

If you want to set up an SSL Reverse-proxy, you need to install httpd. When httpd_setup_enable is true, Nexus will bind to 127.0.0.1:8081 and won’t be directly accessible from external IPs.

• ldap_connections: []

Use this for setting up LDAP connections.

Example configuration item:

  - ldap_name: 'My Company LDAP'
    ldap_protocol: 'ldaps'
    ldap_hostname: 'ldap.mycompany.com'
    ldap_port: 636
    ldap_search_base: 'dc=mycompany,dc=net'
    ldap_user_base_dn: 'ou=users'

• nexus_privileges: []

List of privileges to create.

• nexus_roles: []

List of roles.

• nexus_local_users: []

Local users to create in Nexus.

• nexus_delete_default_repos: false

Delete default repositories from the initial Nexus setup. This only happens on the first installation if nexus_data_dir is empty.

• nexus_blobstores: []

Configuration for blobstores.

• nexus_scheduled_tasks: []

Define any scheduled tasks for automation.

• nexus_repos_maven_proxy: []

Configuration for Maven proxy repositories.

• nexus_repos_maven_hosted: []

Configuration for Maven hosted repositories.

• nexus_repos_maven_group: []

Configuration for Maven group repositories.

Dependencies

This role requires Ansible version 2.1 or higher.

The requirements for Java and httpd can be met with these Galaxy roles:

• ansiblebit.oracle-java
• geerlingguy.apache

Example Playbook

---
- name: Nexus
  hosts: nexus
  become: yes

  vars:
    nexus_version: '3.1.0-04'
    nexus_timezone: 'Canada/Eastern'
    nexus_admin_password: "{{ vault_nexus_admin_password }}"
    httpd_server_name: 'nexus.vm'
    httpd_setup_enable: true
    ldap_connections:
      - ldap_name: 'Company LDAP'
        ldap_protocol: 'ldaps'
        ldap_hostname: 'ldap.company.com'
        ldap_port: 636
        ldap_search_base: 'dc=company,dc=net'
        ldap_user_base_dn: 'ou=users'
        
    nexus_privileges:
      - name: all-repos-read
        description: 'Read & Browse access to all repos'
        repository: '*'
        actions: 
          - read
          - browse

    nexus_roles:
      - id: Developers
        name: developers
        privileges:
          - nx-search-read
          - all-repos-read
          
    nexus_local_users:
      - username: jenkins
        first_name: Jenkins
        last_name: CI
        email: [email protected]
        password: "s3cr3t"

  roles:
    - role: ansiblebit.oracle-java
      oracle_java_set_as_default: yes
    - role: geerlingguy.apache
    - role: savoirfairelinux.nexus3-oss

License

GNU GPLv3

Author Information

See Savoir-faire Linux GitHub for more details.