Add Nexus Repository Manager with Docker registry and Authelia auth

Nexus provides artifact storage (Maven, raw, etc.) and a private Docker
registry at registry.swave.lol. Authelia forward-auth protects Gerrit,
Jenkins, and Nexus behind SSO. Includes setup guide, nginx config,
certbot domains, and a Jenkins pipeline example for artifact uploads.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

9 files changed, 439 insertions, 22 deletions

diff --git a/.gitignore b/.gitignore
index d50cc87..ddb6888 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 .env
 doc/servers.drawio
 doc/Servers.drawio
+authelia/config/users_database.yml
diff --git a/CLAUDE.md b/CLAUDE.md
index 1bb1ef1..0ab9222 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -5,7 +5,7 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 
 ## Domain
 - Primary domain: `swave.lol`
-- Subdomains: `blog.swave.lol`, `ghost.swave.lol`, `jenkins.swave.lol`, `cgit.swave.lol`, `gerrit.swave.lol`
+- Subdomains: `blog.swave.lol`, `ghost.swave.lol`, `jenkins.swave.lol`, `cgit.swave.lol`, `gerrit.swave.lol`, `nexus.swave.lol`, `registry.swave.lol`
 
 ## Services / Stacks
 
@@ -64,10 +64,22 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Startup script: `jenkins/init.groovy.d/clear-stuck-builds.groovy` auto-cleans stuck builds on restart
 - Currently runs all builds on the controller via DooD; supports adding permanent SSH agents for scaling (see setup guide 6.6)
 
+### Nexus (artifact repository & Docker registry)
+- Dir: `nexus/`
+- Compose: `nexus/docker-compose.yaml`
+- Image: `sonatype/nexus3:latest` (no custom Dockerfile)
+- Network: `nexus_network` (172.25.0.0/16, static IP 172.25.0.2)
+- Nexus web UI on port 8081 internally, Docker registry API on port 5000
+- No host ports (accessed only via main nginx reverse proxy)
+- Volume: `/var/nexus-data` (must be owned by UID 200)
+- Accessible at `https://nexus.swave.lol` and `https://swave.lol/nexus`
+- Docker registry accessible at `https://registry.swave.lol`
+- Docker registry requires manual setup after first login: create a "docker (hosted)" repository with HTTP connector on port 5000
+
 ### Nginx (reverse proxy)
 - Dir: `nginx/`
 - Compose: `nginx/docker-compose.yaml`
-- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`
+- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `nexus_network`
 - Ports: 80 (HTTP, redirects to HTTPS), 443 (HTTPS)
 - Config mounted from `/var/nginx/conf/` on host
 - SSL: Let's Encrypt certs via `run_certbot.sh`, dhparam at `/var/dh_param/`
@@ -81,14 +93,16 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 - `git-network` — git-server + cgit + gerrit + nginx
 - `ghost_network` — ghost + ghost-db + nginx
 - `jenkins_network` — jenkins + git-server + gerrit + nginx
+- `nexus_network` — nexus + nginx
 
 ## Startup Order
 1. Portainer (standalone)
 2. Git Server (creates git-network)
 3. Ghost (creates ghost_network)
 4. Jenkins (creates jenkins_network)
-5. Gerrit (joins git-network + jenkins_network, both must exist)
-6. Nginx (joins all networks, must be last)
+5. Nexus (creates nexus_network)
+6. Gerrit (joins git-network + jenkins_network, both must exist)
+7. Nginx (joins all networks, must be last)
 
 ## Key Files
 - `doc/setup-guide.md` — full build instructions from fresh Debian
@@ -97,6 +111,8 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 - `doc/jenkins-cpp-build.md` — guide for building C++ apps in Jenkins with Docker agent
 - `jenkins/kernel-builder/Dockerfile` — custom Docker image for building the Linux kernel
 - `jenkins/init.groovy.d/clear-stuck-builds.groovy` — startup script to clean stuck pipeline executions
+- `nexus/docker-compose.yaml` — Nexus Repository Manager + Docker registry
+- `doc/Jenkinsfile.nexus-example` — example pipelines for uploading artifacts and Docker images to Nexus
 - `ghost/.env.example` — template for Ghost env vars
 - `doc/git-performance.md` — git server performance tuning guide
 - `nginx/error-pages/unknown-host.html` — 404 page for unknown subdomains
@@ -113,5 +129,5 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
 - Automatic certificate renewal for Let's Encrypt
 - Better organization of nginx configs (split per service?)
 - ~~Cgit web interface for git repos~~ (done)
-- Nexus (mentioned in Readme but not yet set up)
+- ~~Nexus~~ (done)
 - Firewall rules (allow only 80, 443, 22, 8080, 8000, 9000, 9418, 50000)
diff --git a/Readme.md b/Readme.md
index bb77cd9..d925152 100644
--- a/Readme.md
+++ b/Readme.md
@@ -94,6 +94,8 @@ Cgit
 
 ### Jenkins
 ### Nexus
+Nexus Repository Manager for storing build artifacts (Maven, generic, etc.) and hosting a private Docker registry.
+Runs as a single container (`sonatype/nexus3`) on `nexus_network`. The web UI is accessible at `https://nexus.swave.lol` and `https://swave.lol/nexus`. A Docker hosted repository on port 5000 provides a private registry at `https://registry.swave.lol`.
 
 
 ## Firewall
diff --git a/doc/Jenkinsfile.nexus-example b/doc/Jenkinsfile.nexus-example
new file mode 100644
index 0000000..c973def
--- /dev/null
+++ b/doc/Jenkinsfile.nexus-example
@@ -0,0 +1,103 @@
+// Example Jenkinsfile — uploading artifacts to Nexus Repository Manager
+//
+// Prerequisites:
+//   1. In Nexus: create a "raw (hosted)" repository named "artifacts"
+//      (Settings > Repositories > Create Repository > raw (hosted))
+//   2. In Jenkins: add Nexus credentials
+//      (Manage Jenkins > Credentials > Add > Username with password, ID: "nexus-credentials")
+//
+// Nexus supports several repository formats. Pick the one that fits your project:
+//
+//   - raw (hosted)   — any file (binaries, tarballs, logs). Simplest option.
+//   - maven2 (hosted) — Java/Maven artifacts (.jar, .pom)
+//   - docker (hosted) — Docker images (use `docker push` instead, see below)
+
+pipeline {
+    agent {
+        docker { image 'maven:3.9-eclipse-temurin-17' }
+    }
+
+    environment {
+        NEXUS_URL = 'https://nexus.swave.lol'
+        NEXUS_CREDS = credentials('nexus-credentials')
+    }
+
+    stages {
+        stage('Build') {
+            steps {
+                sh 'mvn clean package -DskipTests'
+            }
+        }
+
+        stage('Test') {
+            steps {
+                sh 'mvn test'
+            }
+        }
+
+        // Option 1: Upload a generic file to a "raw" repository
+        stage('Upload to Nexus (raw)') {
+            steps {
+                sh '''
+                    curl -u "$NEXUS_CREDS" \
+                         --upload-file target/myapp-1.0.jar \
+                         "$NEXUS_URL/repository/artifacts/myapp/${BUILD_NUMBER}/myapp-1.0.jar"
+                '''
+            }
+        }
+
+        // Option 2: Deploy a Maven artifact using mvn deploy
+        // Requires <distributionManagement> in pom.xml pointing to Nexus,
+        // or use -DaltDeploymentRepository on the command line:
+        //
+        // stage('Deploy to Nexus (Maven)') {
+        //     steps {
+        //         sh '''
+        //             mvn deploy \
+        //                 -DskipTests \
+        //                 -DaltDeploymentRepository=nexus::default::${NEXUS_URL}/repository/maven-releases/
+        //                 -s settings.xml
+        //         '''
+        //     }
+        // }
+    }
+}
+
+// -------------------------------------------------------------------
+// Docker image example (separate pipeline)
+// -------------------------------------------------------------------
+// To push a Docker image to the Nexus Docker registry, use a pipeline
+// like this. Requires Docker socket access (DooD) — no Maven needed.
+//
+// pipeline {
+//     agent any
+//
+//     environment {
+//         REGISTRY = 'registry.swave.lol'
+//         IMAGE    = "${REGISTRY}/myapp:${BUILD_NUMBER}"
+//     }
+//
+//     stages {
+//         stage('Build Image') {
+//             steps {
+//                 sh "docker build -t ${IMAGE} ."
+//             }
+//         }
+//
+//         stage('Push to Registry') {
+//             steps {
+//                 withCredentials([usernamePassword(
+//                     credentialsId: 'nexus-credentials',
+//                     usernameVariable: 'USER',
+//                     passwordVariable: 'PASS'
+//                 )]) {
+//                     sh '''
+//                         echo "$PASS" | docker login $REGISTRY -u "$USER" --password-stdin
+//                         docker push $IMAGE
+//                         docker logout $REGISTRY
+//                     '''
+//                 }
+//             }
+//         }
+//     }
+// }
diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index f949c18..9a5c9d0 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -12,6 +12,8 @@ Full instruction to build the server from a fresh Debian installation.
   - `jenkins.swave.lol`
   - `cgit.swave.lol`
   - `gerrit.swave.lol`
+  - `nexus.swave.lol`
+  - `registry.swave.lol`
 
 
 ## 1. Install Docker
@@ -367,16 +369,77 @@ Once agents are set up, you can stop running builds on the controller:
 Now all builds will be routed to agents only.
 
 
-## 7. Gerrit (Code Review)
+## 7. Nexus (Artifact Repository & Docker Registry)
 
 ### 7.1 Create host directories
 
 ```bash
+mkdir -p /var/nexus-data
+chown 200:200 /var/nexus-data  # Nexus runs as UID 200 inside container
+```
+
+### 7.2 Start Nexus
+
+```bash
+cd /root/Projects/bastion/nexus
+docker compose up -d
+```
+
+Nexus takes ~2 minutes to start. Check logs with:
+
+```bash
+docker logs -f nexus
+```
+
+### 7.3 Get initial admin password
+
+```bash
+docker exec nexus cat /nexus-data/admin.password
+```
+
+Access Nexus at `http://<server-ip>:8081` for initial setup (before Nginx is configured),
+or at `https://nexus.swave.lol` / `https://swave.lol/nexus` after Nginx is running.
+
+Complete the setup wizard: set a new admin password and configure anonymous access.
+
+### 7.4 Configure Docker hosted repository
+
+After completing initial setup, create a Docker registry in Nexus:
+
+1. Log into Nexus UI
+2. Go to **Settings** (gear icon) > **Repositories** > **Create Repository**
+3. Choose **docker (hosted)**
+4. Configure:
+   - **Name**: `docker-hosted`
+   - **HTTP**: check the box, set port to **5000**
+   - **Enable Docker V1 API**: leave unchecked
+5. Click **Create Repository**
+
+Docker clients can now use `registry.swave.lol` as the registry address:
+
+```bash
+# Log in
+docker login registry.swave.lol
+
+# Tag and push an image
+docker tag my-image:latest registry.swave.lol/my-image:latest
+docker push registry.swave.lol/my-image:latest
+
+# Pull an image
+docker pull registry.swave.lol/my-image:latest
+```
+
+
+## 8. Gerrit (Code Review)
+
+### 8.1 Create host directories
+
+```bash
 mkdir -p /var/gerrit/{etc,git,db,index,cache}
 chown -R 1000:1000 /var/gerrit  # gerrit user inside container runs as UID 1000
 ```
 
-### 7.2 Start Gerrit
+### 8.2 Start Gerrit
 
 Gerrit is part of the git-server stack. It requires `jenkins_network` to exist,
 so Jenkins must be started first.
@@ -389,11 +452,11 @@ docker compose -f server.yaml up -d gerrit
 Gerrit shares `/var/git/repos` with git-server for repository access.
 
 
-## 8. Cockpit & Netdata (Monitoring)
+## 9. Cockpit & Netdata (Monitoring)
 
 See `cockpit/setup.md` for full Cockpit installation and configuration details.
 
-### 8.1 Install Cockpit (native, on the host)
+### 9.1 Install Cockpit (native, on the host)
 
 ```bash
 apt install cockpit cockpit-storaged cockpit-networkmanager
@@ -415,7 +478,7 @@ systemctl restart cockpit
 
 See `cockpit/setup.md` for full details.
 
-### 8.2 Start Netdata (Docker)
+### 9.2 Start Netdata (Docker)
 
 ```bash
 cd /root/Projects/bastion/netdata
@@ -424,7 +487,7 @@ docker compose up -d
 
 This creates `monitoring_network` (172.24.0.0/16) with Netdata at 172.24.0.2.
 
-### 8.3 Add location blocks to nginx.conf
+### 9.3 Add location blocks to nginx.conf
 
 Add the contents of `cockpit/nginx-cockpit.conf` and `netdata/nginx-netdata.conf`
 to the `swave.lol` HTTPS server block in `/var/nginx/conf/nginx.conf`.
@@ -440,12 +503,12 @@ Cockpit and Netdata will be available at:
 - `https://swave.lol/netdata/`
 
 
-## 9. Nginx (Reverse Proxy + SSL)
+## 10. Nginx (Reverse Proxy + SSL)
 
 Nginx must be started AFTER Git Server, Ghost, Jenkins, and Gerrit, because it joins
 their networks as external.
 
-### 9.1 Create host directories
+### 10.1 Create host directories
 
 ```bash
 # Nginx config directory
@@ -466,7 +529,7 @@ mkdir -p /var/letsencrypt/lts_site
 cp /root/Projects/bastion/nginx/letsencrypt/index.html /var/letsencrypt/lts_site/
 ```
 
-### 9.2 First run — HTTP only (no SSL yet)
+### 10.2 First run — HTTP only (no SSL yet)
 
 Before we have SSL certificates, we need to temporarily disable the SSL server
 blocks so Nginx can start and serve the ACME challenge for certbot.
@@ -485,7 +548,7 @@ cd /root/Projects/bastion/nginx
 docker compose up -d
 ```
 
-### 9.3 Obtain SSL certificates
+### 10.3 Obtain SSL certificates
 
 ```bash
 cd /root/Projects/bastion/nginx
@@ -498,10 +561,12 @@ This requests certificates for:
 - `jenkins.swave.lol`
 - `cgit.swave.lol`
 - `gerrit.swave.lol`
+- `nexus.swave.lol`
+- `registry.swave.lol`
 
 IMPORTANT: All DNS records must be pointing to the server before running certbot.
 
-### 9.4 Enable SSL
+### 10.4 Enable SSL
 
 ```bash
 # Restore full nginx.conf with SSL blocks
@@ -512,7 +577,7 @@ cd /root/Projects/bastion/nginx
 docker compose restart
 ```
 
-### 9.5 Verify
+### 10.5 Verify
 
 All services should now be accessible:
 
@@ -526,6 +591,9 @@ All services should now be accessible:
 | `https://cgit.swave.lol` | Cgit (subdomain) |
 | `https://swave.lol/gerrit` | Gerrit (path-based) |
 | `https://gerrit.swave.lol` | Gerrit (subdomain) |
+| `https://swave.lol/nexus` | Nexus (path-based) |
+| `https://nexus.swave.lol` | Nexus (subdomain) |
+| `https://registry.swave.lol` | Docker Registry (via Nexus) |
 | `https://swave.lol/cockpit/` | Cockpit (server admin) |
 | `https://swave.lol/netdata/` | Netdata (metrics) |
 | `http://<server-ip>:9000` | Portainer |
@@ -554,6 +622,10 @@ jenkins_network (172.23.0.0/16)
 ├── gerrit         (172.23.0.4)
 └── nginx
 
+nexus_network (172.25.0.0/16)
+├── nexus          (172.25.0.2)
+└── nginx
+
 monitoring_network (172.24.0.0/16)
 ├── netdata        (172.24.0.2)
 └── nginx
@@ -585,13 +657,16 @@ docker compose -f /root/Projects/bastion/ghost/compose.yml up -d
 # 4. Jenkins (creates jenkins_network)
 docker compose -f /root/Projects/bastion/jenkins/docker-compose.yaml up -d
 
-# 5. Gerrit (joins git-network + jenkins_network, both must exist)
+# 5. Nexus (creates nexus_network)
+docker compose -f /root/Projects/bastion/nexus/docker-compose.yaml up -d
+
+# 6. Gerrit (joins git-network + jenkins_network, both must exist)
 docker compose -f /root/Projects/bastion/git-server/server.yaml up -d gerrit
 
-# 6. Netdata (creates monitoring_network)
+# 7. Netdata (creates monitoring_network)
 docker compose -f /root/Projects/bastion/netdata/docker-compose.yaml up -d
 
-# 7. Nginx (joins all networks — must be last)
+# 8. Nginx (joins all networks — must be last)
 docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 ```
 
@@ -606,6 +681,7 @@ docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 | 2368 | Ghost (direct, for testing) | TCP |
 | 8080 | Jenkins (direct, for testing) | TCP |
 | 9000 | Portainer (web UI) | TCP |
+| 8081 | Nexus (direct, for testing) | TCP |
 | 9090 | Cockpit (native, host only — proxied via nginx) | TCP |
 | 9418 | Git Server (git daemon) | TCP |
 | 50000 | Jenkins (agent communication) | TCP |
diff --git a/nexus/docker-compose.yaml b/nexus/docker-compose.yaml
new file mode 100644
index 0000000..e6b7093
--- /dev/null
+++ b/nexus/docker-compose.yaml
@@ -0,0 +1,21 @@
+services:
+  nexus:
+    image: sonatype/nexus3:latest
+    container_name: nexus
+    restart: always
+    environment:
+      - NEXUS_CONTEXT=nexus
+    volumes:
+      - /var/nexus-data:/nexus-data
+    networks:
+      nexus_network:
+        ipv4_address: 172.25.0.2
+
+networks:
+  nexus_network:
+    name: nexus_network
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.25.0.0/16
+          gateway: 172.25.0.1
diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml
index 5066f79..86dfc74 100644
--- a/nginx/docker-compose.yaml
+++ b/nginx/docker-compose.yaml
@@ -22,6 +22,8 @@ services:
       ghost_network:
       jenkins_network:
       monitoring_network:
+      nexus_network:
+      authelia_network:
 
 networks:
   #write each stack network (or connect it manually later)
@@ -37,4 +39,10 @@ networks:
   monitoring_network:
     name: monitoring_network
     external: true
+  nexus_network:
+    name: nexus_network
+    external: true
+  authelia_network:
+    name: authelia_network
+    external: true
 
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 063ff2a..382ee62 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -45,7 +45,7 @@ server {
     listen 80;
     listen [::]:80;
 
-    server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol;
+    server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol nexus.swave.lol registry.swave.lol auth.swave.lol;
 
     location / {
         rewrite ^ https://$host$request_uri? permanent;
@@ -117,15 +117,20 @@ server {
 
     # Gerrit via path prefix on main domain
     location /gerrit {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://gerrit:8080/gerrit;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-User $authelia_user;
     }
 
     # Jenkins via path prefix on main domain
     location /jenkins {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://jenkins:8080/jenkins;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -133,6 +138,18 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
+    # Nexus via path prefix on main domain
+    location /nexus {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://nexus:8081/nexus;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 1G;
+    }
+
     # Reverse proxy to Ghost
     location / {
         proxy_pass http://ghost:2368;
@@ -141,6 +158,25 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
 }
 
 # Jenkins — jenkins.swave.lol
@@ -181,12 +217,33 @@ server {
     }
 
     location /jenkins {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://jenkins:8080/jenkins;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
 }
 
 # Cgit — cgit.swave.lol
@@ -261,10 +318,140 @@ server {
     charset utf-8;
 
     location / {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://gerrit:8080;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-User $authelia_user;
+    }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
+}
+
+# Nexus — nexus.swave.lol
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name nexus.swave.lol;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+    charset utf-8;
+    client_max_body_size 1G;
+
+    location = / {
+        return 302 https://$host/nexus/;
+    }
+
+    location /nexus {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://nexus:8081/nexus;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
+}
+
+# Docker Registry — registry.swave.lol
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name registry.swave.lol;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+    charset utf-8;
+    client_max_body_size 2G;
+    chunked_transfer_encoding on;
+
+    location / {
+        proxy_pass http://nexus:5000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh
index d3fbb02..9c4ba83 100644
--- a/nginx/run_certbot.sh
+++ b/nginx/run_certbot.sh
@@ -23,4 +23,7 @@ docker run -it --rm \
   -d ghost.$domain \
   -d jenkins.$domain \
   -d cgit.$domain \
-  -d gerrit.$domain
+  -d gerrit.$domain \
+  -d nexus.$domain \
+  -d registry.$domain \
+  -d auth.$domain