summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.gitignore1
-rw-r--r--CLAUDE.md26
-rw-r--r--Readme.md2
-rw-r--r--doc/Jenkinsfile.nexus-example103
-rw-r--r--doc/setup-guide.md106
-rw-r--r--nexus/docker-compose.yaml21
-rw-r--r--nginx/docker-compose.yaml8
-rw-r--r--nginx/nginx.conf189
-rw-r--r--nginx/run_certbot.sh5
9 files changed, 439 insertions, 22 deletions
diff --git a/.gitignore b/.gitignore
index d50cc87..ddb6888 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
.env
doc/servers.drawio
doc/Servers.drawio
+authelia/config/users_database.yml
diff --git a/CLAUDE.md b/CLAUDE.md
index 1bb1ef1..0ab9222 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -5,7 +5,7 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
## Domain
- Primary domain: `swave.lol`
-- Subdomains: `blog.swave.lol`, `ghost.swave.lol`, `jenkins.swave.lol`, `cgit.swave.lol`, `gerrit.swave.lol`
+- Subdomains: `blog.swave.lol`, `ghost.swave.lol`, `jenkins.swave.lol`, `cgit.swave.lol`, `gerrit.swave.lol`, `nexus.swave.lol`, `registry.swave.lol`
## Services / Stacks
@@ -64,10 +64,22 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
- Startup script: `jenkins/init.groovy.d/clear-stuck-builds.groovy` auto-cleans stuck builds on restart
- Currently runs all builds on the controller via DooD; supports adding permanent SSH agents for scaling (see setup guide 6.6)
+### Nexus (artifact repository & Docker registry)
+- Dir: `nexus/`
+- Compose: `nexus/docker-compose.yaml`
+- Image: `sonatype/nexus3:latest` (no custom Dockerfile)
+- Network: `nexus_network` (172.25.0.0/16, static IP 172.25.0.2)
+- Nexus web UI on port 8081 internally, Docker registry API on port 5000
+- No host ports (accessed only via main nginx reverse proxy)
+- Volume: `/var/nexus-data` (must be owned by UID 200)
+- Accessible at `https://nexus.swave.lol` and `https://swave.lol/nexus`
+- Docker registry accessible at `https://registry.swave.lol`
+- Docker registry requires manual setup after first login: create a "docker (hosted)" repository with HTTP connector on port 5000
+
### Nginx (reverse proxy)
- Dir: `nginx/`
- Compose: `nginx/docker-compose.yaml`
-- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`
+- Network: joins `git-network` (IP 172.22.0.254), `ghost_network`, `jenkins_network`, `nexus_network`
- Ports: 80 (HTTP, redirects to HTTPS), 443 (HTTPS)
- Config mounted from `/var/nginx/conf/` on host
- SSL: Let's Encrypt certs via `run_certbot.sh`, dhparam at `/var/dh_param/`
@@ -81,14 +93,16 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
- `git-network` — git-server + cgit + gerrit + nginx
- `ghost_network` — ghost + ghost-db + nginx
- `jenkins_network` — jenkins + git-server + gerrit + nginx
+- `nexus_network` — nexus + nginx
## Startup Order
1. Portainer (standalone)
2. Git Server (creates git-network)
3. Ghost (creates ghost_network)
4. Jenkins (creates jenkins_network)
-5. Gerrit (joins git-network + jenkins_network, both must exist)
-6. Nginx (joins all networks, must be last)
+5. Nexus (creates nexus_network)
+6. Gerrit (joins git-network + jenkins_network, both must exist)
+7. Nginx (joins all networks, must be last)
## Key Files
- `doc/setup-guide.md` — full build instructions from fresh Debian
@@ -97,6 +111,8 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
- `doc/jenkins-cpp-build.md` — guide for building C++ apps in Jenkins with Docker agent
- `jenkins/kernel-builder/Dockerfile` — custom Docker image for building the Linux kernel
- `jenkins/init.groovy.d/clear-stuck-builds.groovy` — startup script to clean stuck pipeline executions
+- `nexus/docker-compose.yaml` — Nexus Repository Manager + Docker registry
+- `doc/Jenkinsfile.nexus-example` — example pipelines for uploading artifacts and Docker images to Nexus
- `ghost/.env.example` — template for Ghost env vars
- `doc/git-performance.md` — git server performance tuning guide
- `nginx/error-pages/unknown-host.html` — 404 page for unknown subdomains
@@ -113,5 +129,5 @@ Each stack has its own Docker network. Nginx joins all of them to reverse proxy:
- Automatic certificate renewal for Let's Encrypt
- Better organization of nginx configs (split per service?)
- ~~Cgit web interface for git repos~~ (done)
-- Nexus (mentioned in Readme but not yet set up)
+- ~~Nexus~~ (done)
- Firewall rules (allow only 80, 443, 22, 8080, 8000, 9000, 9418, 50000)
diff --git a/Readme.md b/Readme.md
index bb77cd9..d925152 100644
--- a/Readme.md
+++ b/Readme.md
@@ -94,6 +94,8 @@ Cgit
### Jenkins
### Nexus
+Nexus Repository Manager for storing build artifacts (Maven, generic, etc.) and hosting a private Docker registry.
+Runs as a single container (`sonatype/nexus3`) on `nexus_network`. The web UI is accessible at `https://nexus.swave.lol` and `https://swave.lol/nexus`. A Docker hosted repository on port 5000 provides a private registry at `https://registry.swave.lol`.
## Firewall
diff --git a/doc/Jenkinsfile.nexus-example b/doc/Jenkinsfile.nexus-example
new file mode 100644
index 0000000..c973def
--- /dev/null
+++ b/doc/Jenkinsfile.nexus-example
@@ -0,0 +1,103 @@
+// Example Jenkinsfile — uploading artifacts to Nexus Repository Manager
+//
+// Prerequisites:
+// 1. In Nexus: create a "raw (hosted)" repository named "artifacts"
+// (Settings > Repositories > Create Repository > raw (hosted))
+// 2. In Jenkins: add Nexus credentials
+// (Manage Jenkins > Credentials > Add > Username with password, ID: "nexus-credentials")
+//
+// Nexus supports several repository formats. Pick the one that fits your project:
+//
+// - raw (hosted) — any file (binaries, tarballs, logs). Simplest option.
+// - maven2 (hosted) — Java/Maven artifacts (.jar, .pom)
+// - docker (hosted) — Docker images (use `docker push` instead, see below)
+
+pipeline {
+ agent {
+ docker { image 'maven:3.9-eclipse-temurin-17' }
+ }
+
+ environment {
+ NEXUS_URL = 'https://nexus.swave.lol'
+ NEXUS_CREDS = credentials('nexus-credentials')
+ }
+
+ stages {
+ stage('Build') {
+ steps {
+ sh 'mvn clean package -DskipTests'
+ }
+ }
+
+ stage('Test') {
+ steps {
+ sh 'mvn test'
+ }
+ }
+
+ // Option 1: Upload a generic file to a "raw" repository
+ stage('Upload to Nexus (raw)') {
+ steps {
+ sh '''
+ curl -u "$NEXUS_CREDS" \
+ --upload-file target/myapp-1.0.jar \
+ "$NEXUS_URL/repository/artifacts/myapp/${BUILD_NUMBER}/myapp-1.0.jar"
+ '''
+ }
+ }
+
+ // Option 2: Deploy a Maven artifact using mvn deploy
+ // Requires <distributionManagement> in pom.xml pointing to Nexus,
+ // or use -DaltDeploymentRepository on the command line:
+ //
+ // stage('Deploy to Nexus (Maven)') {
+ // steps {
+ // sh '''
+ // mvn deploy \
+ // -DskipTests \
+ // -DaltDeploymentRepository=nexus::default::${NEXUS_URL}/repository/maven-releases/
+ // -s settings.xml
+ // '''
+ // }
+ // }
+ }
+}
+
+// -------------------------------------------------------------------
+// Docker image example (separate pipeline)
+// -------------------------------------------------------------------
+// To push a Docker image to the Nexus Docker registry, use a pipeline
+// like this. Requires Docker socket access (DooD) — no Maven needed.
+//
+// pipeline {
+// agent any
+//
+// environment {
+// REGISTRY = 'registry.swave.lol'
+// IMAGE = "${REGISTRY}/myapp:${BUILD_NUMBER}"
+// }
+//
+// stages {
+// stage('Build Image') {
+// steps {
+// sh "docker build -t ${IMAGE} ."
+// }
+// }
+//
+// stage('Push to Registry') {
+// steps {
+// withCredentials([usernamePassword(
+// credentialsId: 'nexus-credentials',
+// usernameVariable: 'USER',
+// passwordVariable: 'PASS'
+// )]) {
+// sh '''
+// echo "$PASS" | docker login $REGISTRY -u "$USER" --password-stdin
+// docker push $IMAGE
+// docker logout $REGISTRY
+// '''
+// }
+// }
+// }
+// }
+// }
diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index f949c18..9a5c9d0 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -12,6 +12,8 @@ Full instruction to build the server from a fresh Debian installation.
- `jenkins.swave.lol`
- `cgit.swave.lol`
- `gerrit.swave.lol`
+ - `nexus.swave.lol`
+ - `registry.swave.lol`
## 1. Install Docker
@@ -367,16 +369,77 @@ Once agents are set up, you can stop running builds on the controller:
Now all builds will be routed to agents only.
-## 7. Gerrit (Code Review)
+## 7. Nexus (Artifact Repository & Docker Registry)
### 7.1 Create host directories
```bash
+mkdir -p /var/nexus-data
+chown 200:200 /var/nexus-data # Nexus runs as UID 200 inside container
+```
+
+### 7.2 Start Nexus
+
+```bash
+cd /root/Projects/bastion/nexus
+docker compose up -d
+```
+
+Nexus takes ~2 minutes to start. Check logs with:
+
+```bash
+docker logs -f nexus
+```
+
+### 7.3 Get initial admin password
+
+```bash
+docker exec nexus cat /nexus-data/admin.password
+```
+
+Access Nexus at `http://<server-ip>:8081` for initial setup (before Nginx is configured),
+or at `https://nexus.swave.lol` / `https://swave.lol/nexus` after Nginx is running.
+
+Complete the setup wizard: set a new admin password and configure anonymous access.
+
+### 7.4 Configure Docker hosted repository
+
+After completing initial setup, create a Docker registry in Nexus:
+
+1. Log into Nexus UI
+2. Go to **Settings** (gear icon) > **Repositories** > **Create Repository**
+3. Choose **docker (hosted)**
+4. Configure:
+ - **Name**: `docker-hosted`
+ - **HTTP**: check the box, set port to **5000**
+ - **Enable Docker V1 API**: leave unchecked
+5. Click **Create Repository**
+
+Docker clients can now use `registry.swave.lol` as the registry address:
+
+```bash
+# Log in
+docker login registry.swave.lol
+
+# Tag and push an image
+docker tag my-image:latest registry.swave.lol/my-image:latest
+docker push registry.swave.lol/my-image:latest
+
+# Pull an image
+docker pull registry.swave.lol/my-image:latest
+```
+
+
+## 8. Gerrit (Code Review)
+
+### 8.1 Create host directories
+
+```bash
mkdir -p /var/gerrit/{etc,git,db,index,cache}
chown -R 1000:1000 /var/gerrit # gerrit user inside container runs as UID 1000
```
-### 7.2 Start Gerrit
+### 8.2 Start Gerrit
Gerrit is part of the git-server stack. It requires `jenkins_network` to exist,
so Jenkins must be started first.
@@ -389,11 +452,11 @@ docker compose -f server.yaml up -d gerrit
Gerrit shares `/var/git/repos` with git-server for repository access.
-## 8. Cockpit & Netdata (Monitoring)
+## 9. Cockpit & Netdata (Monitoring)
See `cockpit/setup.md` for full Cockpit installation and configuration details.
-### 8.1 Install Cockpit (native, on the host)
+### 9.1 Install Cockpit (native, on the host)
```bash
apt install cockpit cockpit-storaged cockpit-networkmanager
@@ -415,7 +478,7 @@ systemctl restart cockpit
See `cockpit/setup.md` for full details.
-### 8.2 Start Netdata (Docker)
+### 9.2 Start Netdata (Docker)
```bash
cd /root/Projects/bastion/netdata
@@ -424,7 +487,7 @@ docker compose up -d
This creates `monitoring_network` (172.24.0.0/16) with Netdata at 172.24.0.2.
-### 8.3 Add location blocks to nginx.conf
+### 9.3 Add location blocks to nginx.conf
Add the contents of `cockpit/nginx-cockpit.conf` and `netdata/nginx-netdata.conf`
to the `swave.lol` HTTPS server block in `/var/nginx/conf/nginx.conf`.
@@ -440,12 +503,12 @@ Cockpit and Netdata will be available at:
- `https://swave.lol/netdata/`
-## 9. Nginx (Reverse Proxy + SSL)
+## 10. Nginx (Reverse Proxy + SSL)
Nginx must be started AFTER Git Server, Ghost, Jenkins, and Gerrit, because it joins
their networks as external.
-### 9.1 Create host directories
+### 10.1 Create host directories
```bash
# Nginx config directory
@@ -466,7 +529,7 @@ mkdir -p /var/letsencrypt/lts_site
cp /root/Projects/bastion/nginx/letsencrypt/index.html /var/letsencrypt/lts_site/
```
-### 9.2 First run — HTTP only (no SSL yet)
+### 10.2 First run — HTTP only (no SSL yet)
Before we have SSL certificates, we need to temporarily disable the SSL server
blocks so Nginx can start and serve the ACME challenge for certbot.
@@ -485,7 +548,7 @@ cd /root/Projects/bastion/nginx
docker compose up -d
```
-### 9.3 Obtain SSL certificates
+### 10.3 Obtain SSL certificates
```bash
cd /root/Projects/bastion/nginx
@@ -498,10 +561,12 @@ This requests certificates for:
- `jenkins.swave.lol`
- `cgit.swave.lol`
- `gerrit.swave.lol`
+- `nexus.swave.lol`
+- `registry.swave.lol`
IMPORTANT: All DNS records must be pointing to the server before running certbot.
-### 9.4 Enable SSL
+### 10.4 Enable SSL
```bash
# Restore full nginx.conf with SSL blocks
@@ -512,7 +577,7 @@ cd /root/Projects/bastion/nginx
docker compose restart
```
-### 9.5 Verify
+### 10.5 Verify
All services should now be accessible:
@@ -526,6 +591,9 @@ All services should now be accessible:
| `https://cgit.swave.lol` | Cgit (subdomain) |
| `https://swave.lol/gerrit` | Gerrit (path-based) |
| `https://gerrit.swave.lol` | Gerrit (subdomain) |
+| `https://swave.lol/nexus` | Nexus (path-based) |
+| `https://nexus.swave.lol` | Nexus (subdomain) |
+| `https://registry.swave.lol` | Docker Registry (via Nexus) |
| `https://swave.lol/cockpit/` | Cockpit (server admin) |
| `https://swave.lol/netdata/` | Netdata (metrics) |
| `http://<server-ip>:9000` | Portainer |
@@ -554,6 +622,10 @@ jenkins_network (172.23.0.0/16)
├── gerrit (172.23.0.4)
└── nginx
+nexus_network (172.25.0.0/16)
+├── nexus (172.25.0.2)
+└── nginx
+
monitoring_network (172.24.0.0/16)
├── netdata (172.24.0.2)
└── nginx
@@ -585,13 +657,16 @@ docker compose -f /root/Projects/bastion/ghost/compose.yml up -d
# 4. Jenkins (creates jenkins_network)
docker compose -f /root/Projects/bastion/jenkins/docker-compose.yaml up -d
-# 5. Gerrit (joins git-network + jenkins_network, both must exist)
+# 5. Nexus (creates nexus_network)
+docker compose -f /root/Projects/bastion/nexus/docker-compose.yaml up -d
+
+# 6. Gerrit (joins git-network + jenkins_network, both must exist)
docker compose -f /root/Projects/bastion/git-server/server.yaml up -d gerrit
-# 6. Netdata (creates monitoring_network)
+# 7. Netdata (creates monitoring_network)
docker compose -f /root/Projects/bastion/netdata/docker-compose.yaml up -d
-# 7. Nginx (joins all networks — must be last)
+# 8. Nginx (joins all networks — must be last)
docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
```
@@ -606,6 +681,7 @@ docker compose -f /root/Projects/bastion/nginx/docker-compose.yaml up -d
| 2368 | Ghost (direct, for testing) | TCP |
| 8080 | Jenkins (direct, for testing) | TCP |
| 9000 | Portainer (web UI) | TCP |
+| 8081 | Nexus (direct, for testing) | TCP |
| 9090 | Cockpit (native, host only — proxied via nginx) | TCP |
| 9418 | Git Server (git daemon) | TCP |
| 50000 | Jenkins (agent communication) | TCP |
diff --git a/nexus/docker-compose.yaml b/nexus/docker-compose.yaml
new file mode 100644
index 0000000..e6b7093
--- /dev/null
+++ b/nexus/docker-compose.yaml
@@ -0,0 +1,21 @@
+services:
+ nexus:
+ image: sonatype/nexus3:latest
+ container_name: nexus
+ restart: always
+ environment:
+ - NEXUS_CONTEXT=nexus
+ volumes:
+ - /var/nexus-data:/nexus-data
+ networks:
+ nexus_network:
+ ipv4_address: 172.25.0.2
+
+networks:
+ nexus_network:
+ name: nexus_network
+ driver: bridge
+ ipam:
+ config:
+ - subnet: 172.25.0.0/16
+ gateway: 172.25.0.1
diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml
index 5066f79..86dfc74 100644
--- a/nginx/docker-compose.yaml
+++ b/nginx/docker-compose.yaml
@@ -22,6 +22,8 @@ services:
ghost_network:
jenkins_network:
monitoring_network:
+ nexus_network:
+ authelia_network:
networks:
#write each stack network (or connect it manually later)
@@ -37,4 +39,10 @@ networks:
monitoring_network:
name: monitoring_network
external: true
+ nexus_network:
+ name: nexus_network
+ external: true
+ authelia_network:
+ name: authelia_network
+ external: true
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 063ff2a..382ee62 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -45,7 +45,7 @@ server {
listen 80;
listen [::]:80;
- server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol;
+ server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol nexus.swave.lol registry.swave.lol auth.swave.lol;
location / {
rewrite ^ https://$host$request_uri? permanent;
@@ -117,15 +117,20 @@ server {
# Gerrit via path prefix on main domain
location /gerrit {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://gerrit:8080/gerrit;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-User $authelia_user;
}
# Jenkins via path prefix on main domain
location /jenkins {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://jenkins:8080/jenkins;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
@@ -133,6 +138,18 @@ server {
proxy_set_header X-Forwarded-Proto $scheme;
}
+ # Nexus via path prefix on main domain
+ location /nexus {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
+ proxy_pass http://nexus:8081/nexus;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ client_max_body_size 1G;
+ }
+
# Reverse proxy to Ghost
location / {
proxy_pass http://ghost:2368;
@@ -141,6 +158,25 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
}
# Jenkins — jenkins.swave.lol
@@ -181,12 +217,33 @@ server {
}
location /jenkins {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://jenkins:8080/jenkins;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
}
# Cgit — cgit.swave.lol
@@ -261,10 +318,140 @@ server {
charset utf-8;
location / {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://gerrit:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-User $authelia_user;
+ }
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
+}
+
+# Nexus — nexus.swave.lol
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+
+ server_name nexus.swave.lol;
+
+ server_tokens off;
+
+ ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+ ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+ ssl_buffer_size 8k;
+
+ ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_prefer_server_ciphers on;
+
+ ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+ ssl_ecdh_curve secp384r1;
+ ssl_session_tickets off;
+
+ # OCSP stapling
+ ssl_stapling on;
+ ssl_stapling_verify on;
+ resolver 8.8.8.8;
+
+ charset utf-8;
+ client_max_body_size 1G;
+
+ location = / {
+ return 302 https://$host/nexus/;
+ }
+
+ location /nexus {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
+ proxy_pass http://nexus:8081/nexus;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ }
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
+}
+
+# Docker Registry — registry.swave.lol
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+
+ server_name registry.swave.lol;
+
+ server_tokens off;
+
+ ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+ ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+ ssl_buffer_size 8k;
+
+ ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_prefer_server_ciphers on;
+
+ ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+ ssl_ecdh_curve secp384r1;
+ ssl_session_tickets off;
+
+ # OCSP stapling
+ ssl_stapling on;
+ ssl_stapling_verify on;
+ resolver 8.8.8.8;
+
+ charset utf-8;
+ client_max_body_size 2G;
+ chunked_transfer_encoding on;
+
+ location / {
+ proxy_pass http://nexus:5000;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
}
}
diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh
index d3fbb02..9c4ba83 100644
--- a/nginx/run_certbot.sh
+++ b/nginx/run_certbot.sh
@@ -23,4 +23,7 @@ docker run -it --rm \
-d ghost.$domain \
-d jenkins.$domain \
-d cgit.$domain \
- -d gerrit.$domain
+ -d gerrit.$domain \
+ -d nexus.$domain \
+ -d registry.$domain \
+ -d auth.$domain
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-05 14:26:42 +0000