Add Nexus Repository Manager with Docker registry and Authelia auth

Nexus provides artifact storage (Maven, raw, etc.) and a private Docker
registry at registry.swave.lol. Authelia forward-auth protects Gerrit,
Jenkins, and Nexus behind SSO. Includes setup guide, nginx config,
certbot domains, and a Jenkins pipeline example for artifact uploads.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

3 files changed, 200 insertions, 2 deletions

diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml
index 5066f79..86dfc74 100644
--- a/nginx/docker-compose.yaml
+++ b/nginx/docker-compose.yaml
@@ -22,6 +22,8 @@ services:
       ghost_network:
       jenkins_network:
       monitoring_network:
+      nexus_network:
+      authelia_network:
 
 networks:
   #write each stack network (or connect it manually later)
@@ -37,4 +39,10 @@ networks:
   monitoring_network:
     name: monitoring_network
     external: true
+  nexus_network:
+    name: nexus_network
+    external: true
+  authelia_network:
+    name: authelia_network
+    external: true
 
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 063ff2a..382ee62 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -45,7 +45,7 @@ server {
     listen 80;
     listen [::]:80;
 
-    server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol;
+    server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol nexus.swave.lol registry.swave.lol auth.swave.lol;
 
     location / {
         rewrite ^ https://$host$request_uri? permanent;
@@ -117,15 +117,20 @@ server {
 
     # Gerrit via path prefix on main domain
     location /gerrit {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://gerrit:8080/gerrit;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-User $authelia_user;
     }
 
     # Jenkins via path prefix on main domain
     location /jenkins {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://jenkins:8080/jenkins;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -133,6 +138,18 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
+    # Nexus via path prefix on main domain
+    location /nexus {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://nexus:8081/nexus;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 1G;
+    }
+
     # Reverse proxy to Ghost
     location / {
         proxy_pass http://ghost:2368;
@@ -141,6 +158,25 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
 }
 
 # Jenkins — jenkins.swave.lol
@@ -181,12 +217,33 @@ server {
     }
 
     location /jenkins {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://jenkins:8080/jenkins;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
 }
 
 # Cgit — cgit.swave.lol
@@ -261,10 +318,140 @@ server {
     charset utf-8;
 
     location / {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
         proxy_pass http://gerrit:8080;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-User $authelia_user;
+    }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
+}
+
+# Nexus — nexus.swave.lol
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name nexus.swave.lol;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+    charset utf-8;
+    client_max_body_size 1G;
+
+    location = / {
+        return 302 https://$host/nexus/;
+    }
+
+    location /nexus {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://nexus:8081/nexus;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        proxy_pass http://authelia:9091/api/verify;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
+}
+
+# Docker Registry — registry.swave.lol
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name registry.swave.lol;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+    charset utf-8;
+    client_max_body_size 2G;
+    chunked_transfer_encoding on;
+
+    location / {
+        proxy_pass http://nexus:5000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
     }
 }
diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh
index d3fbb02..9c4ba83 100644
--- a/nginx/run_certbot.sh
+++ b/nginx/run_certbot.sh
@@ -23,4 +23,7 @@ docker run -it --rm \
   -d ghost.$domain \
   -d jenkins.$domain \
   -d cgit.$domain \
-  -d gerrit.$domain
+  -d gerrit.$domain \
+  -d nexus.$domain \
+  -d registry.$domain \
+  -d auth.$domain