Add Nexus Repository Manager with Docker registry and Authelia auth

Nexus provides artifact storage (Maven, raw, etc.) and a private Docker
registry at registry.swave.lol. Authelia forward-auth protects Gerrit,
Jenkins, and Nexus behind SSO. Includes setup guide, nginx config,
certbot domains, and a Jenkins pipeline example for artifact uploads.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2 files changed, 194 insertions, 15 deletions

diff --git a/doc/Jenkinsfile.nexus-example b/doc/Jenkinsfile.nexus-example
new file mode 100644
index 0000000..c973def
--- /dev/null
+++ b/doc/Jenkinsfile.nexus-example
@@ -0,0 +1,103 @@
+// Example Jenkinsfile — uploading artifacts to Nexus Repository Manager
+//
+// Prerequisites:
+//   1. In Nexus: create a "raw (hosted)" repository named "artifacts"
+//      (Settings > Repositories > Create Repository > raw (hosted))
+//   2. In Jenkins: add Nexus credentials
+//      (Manage Jenkins > Credentials > Add > Username with password, ID: "nexus-credentials")
+//
+// Nexus supports several repository formats. Pick the one that fits your project:
+//
+//   - raw (hosted)   — any file (binaries, tarballs, logs). Simplest option.
+//   - maven2 (hosted) — Java/Maven artifacts (.jar, .pom)
+//   - docker (hosted) — Docker images (use `docker push` instead, see below)
+
+pipeline {
+    agent {
+        docker { image 'maven:3.9-eclipse-temurin-17' }
+    }
+
+    environment {
+        NEXUS_URL = 'https://nexus.swave.lol'
+        NEXUS_CREDS = credentials('nexus-credentials')
+    }
+
+    stages {
+        stage('Build') {
+            steps {
+                sh 'mvn clean package -DskipTests'
+            }
+        }
+
+        stage('Test') {
+            steps {
+                sh 'mvn test'
+            }
+        }
+
+        // Option 1: Upload a generic file to a "raw" repository
+        stage('Upload to Nexus (raw)') {
+            steps {
+                sh '''
+                    curl -u "$NEXUS_CREDS" \
+                         --upload-file target/myapp-1.0.jar \
+                         "$NEXUS_URL/repository/artifacts/myapp/${BUILD_NUMBER}/myapp-1.0.jar"
+                '''
+            }
+        }
+
+        // Option 2: Deploy a Maven artifact using mvn deploy
+        // Requires <distributionManagement> in pom.xml pointing to Nexus,
+        // or use -DaltDeploymentRepository on the command line:
+        //
+        // stage('Deploy to Nexus (Maven)') {
+        //     steps {
+        //         sh '''
+        //             mvn deploy \
+        //                 -DskipTests \
+        //                 -DaltDeploymentRepository=nexus::default::${NEXUS_URL}/repository/maven-releases/
+        //                 -s settings.xml
+        //         '''
+        //     }
+        // }
+    }
+}
+
+// -------------------------------------------------------------------
+// Docker image example (separate pipeline)
+// -------------------------------------------------------------------
+// To push a Docker image to the Nexus Docker registry, use a pipeline
+// like this. Requires Docker socket access (DooD) — no Maven needed.
+//
+// pipeline {
+//     agent any
+//
+//     environment {
+//         REGISTRY = 'registry.swave.lol'
+//         IMAGE    = "${REGISTRY}/myapp:${BUILD_NUMBER}"
+//     }
+//
+//     stages {
+//         stage('Build Image') {
+//             steps {
+//                 sh "docker build -t ${IMAGE} ."
+//             }
+//         }
+//
+//         stage('Push to Registry') {
+//             steps {
+//                 withCredentials([usernamePassword(
+//                     credentialsId: 'nexus-credentials',
+//                     usernameVariable: 'USER',
+//                     passwordVariable: 'PASS'
+//                 )]) {
+//                     sh '''
+//                         echo "$PASS" | docker login $REGISTRY -u "$USER" --password-stdin
+//                         docker push $IMAGE
+//                         docker logout $REGISTRY
+//                     '''
+//                 }
+//             }
+//         }
+//     }
+// }
diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index f949c18..9a5c9d0 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -12,6 +12,8 @@ Full instruction to build the server from a fresh Debian installation.
   - `jenkins.swave.lol`
   - `cgit.swave.lol`
   - `gerrit.swave.lol`
+  - `nexus.swave.lol`
+  - `registry.swave.lol`
 
 
 ## 1. Install Docker
@@ -367,16 +369,77 @@ Once agents are set up, you can stop running builds on the controller:
 Now all builds will be routed to agents only.
 
 
-## 7. Gerrit (Code Review)
+## 7. Nexus (Artifact Repository & Docker Registry)
 
 ### 7.1 Create host directories
 
 ```bash
+mkdir -p /var/nexus-data
+chown 200:200 /var/nexus-data  # Nexus runs as UID 200 inside container
+```
+
+### 7.2 Start Nexus
+
+```bash
+cd /root/Projects/bastion/nexus
+docker compose up -d
+```
+
+Nexus takes ~2 minutes to start. Check logs with:
+
+```bash
+docker logs -f nexus
+```
+
+### 7.3 Get initial admin password
+
+```bash
+docker exec nexus cat /nexus-data/admin.password
+```
+
+Access Nexus at `http://<server-ip>:8081` for initial setup (before Nginx is configured),
+or at `https://nexus.swave.lol` / `https://swave.lol/nexus` after Nginx is running.
+
+Complete the setup wizard: set a new admin password and configure anonymous access.
+
+### 7.4 Configure Docker hosted repository
+
+After completing initial setup, create a Docker registry in Nexus:
+
+1. Log into Nexus UI
+2. Go to **Settings** (gear icon) > **Repositories** > **Create Repository**
+3. Choose **docker (hosted)**
+4. Configure:
+   - **Name**: `docker-hosted`
+   - **HTTP**: check the box, set port to **5000**
+   - **Enable Docker V1 API**: leave unchecked
+5. Click **Create Repository**
+
+Docker clients can now use `registry.swave.lol` as the registry address:
+
+```bash
+# Log in
+docker login registry.swave.lol
+
+# Tag and push an image
+docker tag my-image:latest registry.swave.lol/my-image:latest
+docker push registry.swave.lol/my-image:latest
+
+# Pull an image
+docker pull registry.swave.lol/my-image:latest
+```
+
+
+## 8. Gerrit (Code Review)
+
+### 8.1 Create host directories
+
+```bash
 mkdir -p /var/gerrit/{etc,git,db,index,cache}
 chown -R 1000:1000 /var/gerrit  # gerrit user inside container runs as UID 1000
 ```
 
-### 7.2 Start Gerrit
+### 8.2 Start Gerrit
 
 Gerrit is part of the git-server stack. It requires `jenkins_network` to exist,
 so Jenkins must be started first.
@@ -389,11 +452,11 @@ docker compose -f server.yaml up -d gerrit
 Gerrit shares `/var/git/repos` with git-server for repository access.
 
 
-## 8. Cockpit & Netdata (Monitoring)
+## 9. Cockpit & Netdata (Monitoring)
 
 See `cockpit/setup.md` for full Cockpit installation and configuration details.
 
-### 8.1 Install Cockpit (native, on the host)
+### 9.1 Install Cockpit (native, on the host)
 
 ```bash
 apt install cockpit cockpit-storaged cockpit-networkmanager
@@ -415,7 +478,7 @@ systemctl restart cockpit
 
 See `cockpit/setup.md` for full details.
 
-### 8.2 Start Netdata (Docker)
+### 9.2 Start Netdata (Docker)
 
 ```bash
 cd /root/Projects/bastion/netdata
@@ -424,7 +487,7 @@ docker compose up -d
 
 This creates `monitoring_network` (172.24.0.0/16) with Netdata at 172.24.0.2.
 
-### 8.3 Add location blocks to nginx.conf
+### 9.3 Add location blocks to nginx.conf
 
 Add the contents of `cockpit/nginx-cockpit.conf` and `netdata/nginx-netdata.conf`
 to the `swave.lol` HTTPS server block in `/var/nginx/conf/nginx.conf`.
@@ -440,12 +503,12 @@ Cockpit and Netdata will be available at:
 - `https://swave.lol/netdata/`
 
 
-## 9. Nginx (Reverse Proxy + SSL)
+## 10. Nginx (Reverse Proxy + SSL)
 
 Nginx must be started AFTER Git Server, Ghost, Jenkins, and Gerrit, because it joins
 their networks as external.
 
-### 9.1 Create host directories
+### 10.1 Create host directories
 
 ```bash
 # Nginx config directory
@@ -466,7 +529,7 @@ mkdir -p /var/letsencrypt/lts_site
 cp /root/Projects/bastion/nginx/letsencrypt/index.html /var/letsencrypt/lts_site/
 ```
 
-### 9.2 First run — HTTP only (no SSL yet)
+### 10.2 First run — HTTP only (no SSL yet)
 
 Before we have SSL certificates, we need to temporarily disable the SSL server
 blocks so Nginx can start and serve the ACME challenge for certbot.
@@ -485,7 +548,7 @@ cd /root/Projects/bastion/nginx
 docker compose up -d
 ```
 
-### 9.3 Obtain SSL certificates
+### 10.3 Obtain SSL certificates
 
 ```bash
 cd /root/Projects/bastion/nginx
@@ -498,10 +561,12 @@ This requests certificates for:
 - `jenkins.swave.lol`
 - `cgit.swave.lol`
 - `gerrit.swave.lol`
+- `nexus.swave.lol`
+- `registry.swave.lol`
 
 IMPORTANT: All DNS records must be pointing to the server before running certbot.
 
-### 9.4 Enable SSL
+### 10.4 Enable SSL
 
 ```bash
 # Restore full nginx.conf with SSL blocks
@@ -512,7 +577,7 @@ cd /root/Projects/bastion/nginx
 docker compose restart
 ```
 
-### 9.5 Verify
+### 10.5 Verify
 
 All services should now be accessible:
 
@@ -526,6 +591,9 @@ All services should now be accessible:
 | `https://cgit.swave.lol` | Cgit (subdomain) |
 | `https://swave.lol/gerrit` | Gerrit (path-based) |
 | `https://gerrit.swave.lol` | Gerrit (subdomain) |
+| `https://swave.lol/nexus` | Nexus (path-based) |
+| `https://nexus.swave.lol` | Nexus (subdomain) |
+| `https://registry.swave.lol` | Docker Registry (via Nexus) |
 | `https://swave.lol/cockpit/` | Cockpit (server admin) |
 | `https://swave.lol/netdata/` | Netdata (metrics) |
 | `http://<server-ip>:9000` | Portainer |
@@ -554,6 +622,10 @@ jenkins_network (172.23.0.0/16)
 ├── gerrit         (172.23.0.4)
 └── nginx
 
+nexus_network (172.25.0.0/16)
+├── nexus          (172.25.0.2)
+└── nginx
+
 monitoring_network (172.24.0.0/16)
 ├── netdata        (172.24.0.2)
 └── nginx
@@ -585,13 +657,16 @@ docker compose -f /root/Projects/bastion/ghost/compose.yml up -d
 # 4. Jenkins (creates jenkins_network)
 docker compose -f /root/Projects/bastion/jenkins/docker-compose.yaml up -d
 
-# 5. Gerrit (joins git-network + jenkins_network, both must exist)
+# 5. Nexus (creates nexus_network)
+docker compose -f /root/Projects/bastion/nexus/docker-compose.yaml up -d
+
+# 6. Gerrit (joins git-network + jenkins_network, both must exist)
 docker compose -f /root/Projects/bastion/git-server/server.yaml up -d gerrit
 
-# 6. Netdata (creates monitoring_network)
+# 7. Netdata (creates monitoring_network)
 docker compose -f /root/Projects/bastion/netdata/docker-compose.yaml up -d
 
-# 7. Nginx (joins all networks — must be last)
+# 8. Nginx (joins all networks — must be last)
 docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 ```
 
@@ -606,6 +681,7 @@ docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
 | 2368 | Ghost (direct, for testing) | TCP |
 | 8080 | Jenkins (direct, for testing) | TCP |
 | 9000 | Portainer (web UI) | TCP |
+| 8081 | Nexus (direct, for testing) | TCP |
 | 9090 | Cockpit (native, host only — proxied via nginx) | TCP |
 | 9418 | Git Server (git daemon) | TCP |
 | 50000 | Jenkins (agent communication) | TCP |