Nexus Repository Editions, Deployment Models, Architecture, Installation, and Java Runtime Planning: Configuration, Design Choices, and Tradeoffs
Choose Nexus runtime, database, deployment topology, resilience model, and edition from explicit reliability, security, recovery, cost, and supportability tradeoffs.
Learning objectives
- Evaluate bundled versus external Java without separating compatibility from supportability.
- Choose H2 or PostgreSQL from workload, topology, recovery, and availability requirements.
- Compare bare-metal/VM, container/cloud-native, and managed-cloud responsibility boundaries.
- Distinguish single-node simplicity from resilient/HA availability patterns and backup requirements.
- Map Community/Pro entitlement decisions to actual production capabilities.
- Defend an architecture choice with observable repository behavior and operational evidence.
Version checkpoint — reviewed 2026-08-26. Sonatype's official download page currently offers Nexus Repository 3.94.1 (build line 3.94.1-06), while Sonatype also publishes an official 3.95.0 release-notes page dated August 5, 2026. Because those primary pages are temporarily out of sync, the executable labs in this chapter pin the currently downloadable 3.94.1-06 archive. Re-check the download page, version-status page, release notes, and known issues before using a newer build. Java 21 is required for current H2/PostgreSQL releases; current official packages include a supported runtime.
1. Design from state and failure domains
A platform decision is useful only when it says what state moves, what can fail independently, who operates it, and how the service recovers. “Use Kubernetes because it scales” is not a Nexus design. “Use a VM because it is simple” is not a Nexus design either. Start with database, blobs, process runtime, network path, workload and recovery objectives, then choose an execution environment that can preserve those invariants.
2. Bundled runtime versus external Java
Current Nexus Repository releases require Java 21, and current official installers/images include a supported runtime. The bundled runtime reduces a compatibility variable: the Nexus package and JVM are tested as one release unit. An external JVM can be justified by organization runtime policy, but it becomes an explicit compatibility/patching responsibility.
| Choice | Benefit | Cost / risk | Evidence to retain |
|---|---|---|---|
| Bundled Java 21 | Fewer compatibility choices; follows official package | Runtime lifecycle tied to Nexus package/update cadence | Nexus version, package identity, System Information JVM |
| Supported external Java 21 | Fits centralized JVM management/security policy | Operator must validate exact Nexus↔JVM compatibility and runtime changes | Java vendor/version, APP_JAVA_HOME/app_java_home, startup log |
| Unsupported Java 17/25 | None for current 3.87+ H2/PostgreSQL line | Startup/support failure or untested behavior | Do not normalize; correct runtime first |
Do not modify Java because “newer must be faster.” A runtime change can alter heap behavior, native/direct memory, TLS providers and metrics. Treat it like a platform upgrade with evidence and rollback.
3. H2 convenience versus PostgreSQL production suitability
H2 collapses database operations into the Nexus process. That makes a disposable lab easy but couples database availability and process lifecycle. Current support limits are explicit: up to 200,000 requests/day or 100,000 components, and no H2 container deployments. Crossing those boundaries is not a tuning challenge; it is a topology problem.
PostgreSQL separates metadata persistence from the Nexus JVM. It
adds a networked service, credentials, backups, upgrades, connection
capacity and latency concerns, but supports production deployment
patterns that H2 does not. Sonatype currently recommends external
PostgreSQL for deployments and requires the database user to own the
database plus the pg_trgm extension.
Blob storage remains a separate decision. PostgreSQL does not “store all packages in SQL.” Nexus still uses blob stores for binary payloads, so backup and recovery must cover both sides consistently.
4. Bare metal/VM versus container/cloud-native
| Deployment | Good fit | State requirement | Watch-outs |
|---|---|---|---|
| Bare metal / VM | Straightforward single-node operations; traditional service management | Durable local/external database and blob paths; backups outside host failure domain | Host patching, filesystem capacity, service user, reboot automation |
| Container / Kubernetes | Declarative scheduling and infrastructure integration when supported topology is used | Persistent supported database/blob architecture; current Sonatype container guidance | Do not run H2 in containers; preserve UID/ownership; probes are not backups |
| Nexus Repository Cloud | Teams wanting managed Nexus service boundary | Provider-managed service internals; client/identity/network responsibilities remain | Self-hosted filesystem/process instructions do not apply; feature/responsibility parity must be checked |
A container image is a packaging/runtime unit, not persistence. If the only copy of repository state is in a writable container layer, the design is broken even if restart automation is perfect.
5. Single node, resilient deployment, HA, and DR answer different questions
A single node minimizes moving parts and is ideal for learning and many small environments. It has an obvious availability limit: when that process/host is unavailable, the service is unavailable.
High availability and resilient deployment options introduce shared/consistent database and blob requirements, node coordination and load balancing. Current feature documentation marks HA/resilient deployment capabilities as Pro. They are not simulated by starting two independent Community nodes against unrelated state.
Backup/disaster recovery is separate from HA. Multiple live nodes cannot undo accidental deletion or logical corruption. A recoverable design needs validated backups and explicit RPO/RTO even if request availability is high.
6. License decisions should follow capability requirements
Do not select Pro because “production means paid,” and do not assume CE has no enterprise-useful controls. Current matrix gives CE external PostgreSQL, AWS S3 blob stores, LDAP, content selectors/custom access control, routing rules, REST/API coverage and more. Conversely, current Pro capabilities include HA/resiliency, SAML, user tokens, content replication, staging/build promotion and selected blob/storage capabilities.
The correct sequence is: define requirement → map it to a named current feature → check the feature matrix → record edition prerequisite → design a free/simulated learning equivalent when the feature is paid-only. Also model CE's current 40,000-component / 100,000-request-per-day usage limits separately from H2's current 100,000-component / 200,000-request-per-day database support limits; whichever bound you hit first governs the design.
7. Keep adjacent configuration in its own owner domain
| Symptom / decision | Primary owner | Why |
|---|---|---|
| Nexus port/context path | Nexus data-dir application configuration | Controls Nexus connector behavior |
| Public TLS certificate / routing | Reverse proxy / load balancer and network platform | Transport/exposure outside core package state |
| Maven local cache points at old URL | Maven client configuration | Server may be correct while client remains stale |
| OIDC/SAML policy | Identity provider + Nexus auth integration | Browser identity is not database/blob configuration |
| CI secret rotation | CI secret store / service identity | Do not encode admin passwords in Nexus scripts |
| PostgreSQL failover | Database platform | Nexus consumes a supported database endpoint; it does not make PostgreSQL active/active |
| S3 bucket durability | Object-storage platform + Nexus blob configuration | Storage durability and Nexus metadata consistency are related but different responsibilities |
8. Worked decision: 35 developers, internal packages, business-hours criticality
Scenario: one team has 35 developers, roughly 15,000 components, 45,000 requests/day, two package formats, an existing PostgreSQL service, no 24×7 availability target, and an RTO of four hours. They need LDAP and path-level authorization, but not SAML, HA, user tokens or content replication.
| Decision | Choice | Justification / observable consequence |
|---|---|---|
| Edition | Community | Current matrix covers LDAP, external PostgreSQL and custom access controls; no paid-only requirement was identified. |
| Database | External PostgreSQL | Existing supported service improves production suitability and keeps metadata persistence independent of JVM restart. |
| Execution | Single VM service | Meets modest availability target with low operational complexity; service restart/reboot is explicit. |
| Blob | Durable local block/filesystem sized with headroom | Simple for one node; backup must coordinate blob + database evidence. |
| Runtime | Bundled supported Java | Removes unnecessary JVM divergence unless policy requires external Java. |
| Exposure | Private network + reverse proxy/TLS | Backend connector is not public; client URL is governed separately. |
| Recovery | Validated DB + blob backup/runbook | Single-node availability does not substitute for recovery. |
If the same organization later requires multi-node active availability, SAML and zero-downtime patterns, the architecture and edition decision change. That is evidence-driven evolution, not an admission that the first design was wrong.
Knowledge check
A team wants to run Nexus 3.94.1 in Docker with embedded H2 because the host volume is persistent. Supported?
No. Current Sonatype system requirements explicitly say container-based deployments are not supported for H2, regardless of mounting a persistent volume.
Does choosing PostgreSQL eliminate the need to back up blob stores?
No. PostgreSQL stores structured metadata/configuration; blob stores hold package bytes. Recovery must preserve and validate the relationship.
Is external PostgreSQL a Pro-only feature today?
No. The current self-hosted feature matrix marks external PostgreSQL support for Community and Pro.
Why prefer the bundled runtime in a default design?
It reduces a compatibility dimension and follows the tested package/runtime combination. External Java is valid only when its compatibility and lifecycle are explicitly owned.
Two independent Community nodes each have their own H2 and local blobs. Is that HA?
No. They do not share consistent application state and are not a coordinated HA deployment. Current HA deployment options are Pro and require a supported architecture.
9. Summary
Architecture choices are contracts over state and failure domains. A supportable Nexus design states its runtime, database, blob topology, execution environment, edition entitlements, network boundary, recovery path, and the evidence that proves those choices remain true.
Official references and version notes
- Download Nexus Repository — official current download page; at review time it presents 3.94.1 as the downloadable self-hosted release.
- Nexus Repository 3.95.0 release notes — official release notes state that 3.95.0 was released August 5, 2026; this is intentionally called out because the download/version indexes can lag.
- Nexus Repository system requirements — supported operating systems, dedicated-user guidance, file handles, Java 21, memory, H2 limits, and PostgreSQL requirements.
- Java Runtime Compatibility Matrix — Java 21 is the supported runtime for H2/PostgreSQL Nexus Repository 3.87.0 and later.
- Install Self-Hosted Nexus Repository — archive installation, default H2/local blob behavior, initial admin state, and deployment planning.
- Configuring the Runtime Environment — install-dir versus data-dir configuration, nexus.vmoptions, nexus.properties, port, context path, logs, and temporary state.
- Nexus Repository Database — embedded H2 versus external PostgreSQL usage boundaries.
- Install Nexus Repository with PostgreSQL — supported external PostgreSQL setup and Nexus datastore configuration.
- Self-Hosted Nexus Repository Feature Matrix — current Community Edition versus Professional capability boundaries.
- Community Edition Onboarding — current CE onboarding/EULA workflow and 40,000-component / 100,000-request-per-day usage limits.
- Usage Center — current Community Edition usage-limit behavior and operational monitoring.
- Status API — current readiness, writable-state, and authenticated status-check endpoints.
- System Information — read-only server evidence including version, install/work directories, host/port, JVM, OS, and runtime details.
- Run as a Service — dedicated process identity, service configuration, and supported runtime override mechanisms.
Version-sensitive statements were rechecked against Sonatype primary documentation on 2026-08-26. The mandatory path remains self-hosted, Community/free-compatible, and disposable; production credentials, production repositories, and paid-only capabilities are outside the lab boundary.
Keep the academy open
Support free, practical DevOps education.
Every lesson is designed to remain readable in a browser, downloadable from GitHub, and usable without a paid learning platform. Contributions help expand and maintain the curriculum.
0x716c4Ab160C4B66F31a28AE2448BfF68fc3a2ef0
Send only Ethereum/ERC-20 compatible assets to this
address.