Checkpoint Lab — TLS, Reverse Proxies, Context Paths, HTTP Settings, Network Boundaries, and Secure Exposure

1. Checkpoint mission

You are preparing a repository endpoint for a team that must publish through HTTPS while the Nexus backend remains private. Your deliverable is not merely a successful upload. It is an evidence packet proving the certificate name, TLS chain, forwarded-edge request, repository write, byte identity, rejection of plain HTTP, and intended backend/firewall boundary.

2. Exact assumptions and preflight

3. Write predictions before changing state

Record at least these predictions in predictions.md before the first upload:

1. A successful HTTPS PUT will create one Raw asset’s Nexus metadata plus blob bytes, but it will not change the TLS certificate or reverse-proxy configuration.
2. A GET through HTTPS will return bytes identical to the producer file; an HTTP request to the lab edge will be rejected before Nexus repository authorization is evaluated.
3. The backend listener will remain reachable locally but not be an intended client endpoint; in a production network, only the reverse-proxy tier would be permitted to reach it.

4. Set up the secured local edge

Reuse the Lesson 2 method, but use fresh checkpoint names. Capture the original Nexus runtime properties, ensure application-host=127.0.0.1, and restart only the disposable instance. Generate a new two-day certificate with SAN DNS:nexus.lab.test. Start the same TLS proxy fixture and plain-HTTP deny listener.

export LAB="$HOME/nexus-ch17-checkpoint"
mkdir -p "$LAB/evidence" "$LAB/cert"

# After generating the checkpoint certificate and starting the fixture:
openssl x509 -in "$LAB/cert/nexus.lab.test.crt" -noout \
  -subject -issuer -dates -fingerprint -sha256 -ext subjectAltName \
  > "$LAB/evidence/certificate.txt"

curl --fail --cacert "$LAB/cert/nexus.lab.test.crt" \
  --resolve nexus.lab.test:8443:127.0.0.1 \
  https://nexus.lab.test:8443/service/rest/v1/status \
  > "$LAB/evidence/status.json"

5. Create the disposable repository and publisher

Create Raw hosted repository academy-ch17-checkpoint using the default blob store, strict content validation, and Allow once. Create academy-ch17-cp-publisher with only browse/read/add/edit privileges for this repository. Do not grant delete, wildcard repository access, security administration, or nx-admin.

Before publication, Browse/Search should show no checkpoint asset. Save that observation as repository-before.txt or a screenshot outside the ZIP if desired.

6. Prepare a secret that never enters the evidence packet

export NX_USER='academy-ch17-cp-publisher'
read -r -s -p 'Checkpoint publisher password: ' NX_PASS; echo
export AUTH_FILE="$(mktemp)"
chmod 600 "$AUTH_FILE"
printf 'machine nexus.lab.test login %s password %s
' "$NX_USER" "$NX_PASS" > "$AUTH_FILE"
unset NX_PASS
# Never print or copy AUTH_FILE.

7. Validate TLS hostname and chain

openssl s_client -connect 127.0.0.1:8443 -servername nexus.lab.test \
  -CAfile "$LAB/cert/nexus.lab.test.crt" </dev/null 2>&1 \
  | grep -E 'subject=|issuer=|Verify return code' \
  | tee "$LAB/evidence/tls-valid.txt"

# Negative proof: same socket, wrong hostname.
set +e
curl --cacert "$LAB/cert/nexus.lab.test.crt" \
  --resolve wrong.lab.test:8443:127.0.0.1 \
  https://wrong.lab.test:8443/service/rest/v1/status \
  2>"$LAB/evidence/tls-wrong-host.txt"
printf 'wrong-host curl exit=%s
' "$?" >> "$LAB/evidence/tls-wrong-host.txt"
set -e

The negative test must fail because the requested hostname is absent from the SAN. Do not add -k to make it pass.

8. Publish one synthetic package-shaped artifact through HTTPS

cat > "$LAB/academy-network-package-1.0.0.txt" <<'EOF'
name=academy-network-package
version=1.0.0
purpose=chapter-17-checkpoint
content=synthetic non-secret training artifact
EOF
sha256sum "$LAB/academy-network-package-1.0.0.txt" \
  | tee "$LAB/evidence/producer.sha256"

export SECURE_URL='https://nexus.lab.test:8443/repository/academy-ch17-checkpoint/com/example/academy/network/1.0.0/academy-network-package-1.0.0.txt'

curl --fail --show-error --cacert "$LAB/cert/nexus.lab.test.crt" \
  --resolve nexus.lab.test:8443:127.0.0.1 --netrc-file "$AUTH_FILE" \
  --upload-file "$LAB/academy-network-package-1.0.0.txt" "$SECURE_URL"

curl --fail --show-error --cacert "$LAB/cert/nexus.lab.test.crt" \
  --resolve nexus.lab.test:8443:127.0.0.1 --netrc-file "$AUTH_FILE" \
  -o "$LAB/consumer.txt" "$SECURE_URL"
sha256sum "$LAB/consumer.txt" | tee "$LAB/evidence/consumer.sha256"
cmp "$LAB/academy-network-package-1.0.0.txt" "$LAB/consumer.txt"

9. Prove the insecure edge path is rejected

curl -sS -i \
  http://127.0.0.1:8080/repository/academy-ch17-checkpoint/com/example/academy/network/1.0.0/academy-network-package-1.0.0.txt \
  | tee "$LAB/evidence/http-rejected.txt"

grep -q '403' "$LAB/evidence/http-rejected.txt"

This rejection is performed by the edge fixture. It must not be interpreted as a Nexus authorization result. That distinction is part of the checkpoint.

10. Capture forwarded-edge and Nexus evidence

tail -n 40 "$LAB/evidence/proxy.log" > "$LAB/evidence/proxy-tail.txt"
tail -n 50 "$NEXUS_DATA/log/request.log" 2>/dev/null \
  > "$LAB/evidence/nexus-request-tail.txt" || true

# Through the Nexus UI or read-only REST API, record:
# repository name, format/type, exact asset path, size, and checksum fields if exposed.
# Do not inspect or copy raw blob files.

Expected proxy evidence includes forwarded_proto=https and external host nexus.lab.test:8443. Expected Nexus evidence shows the PUT/GET path and the created Raw asset through supported repository state.

11. Document intended network zones and firewall rules

Create $LAB/evidence/network-boundary.md with a table like this, adapted to your real production design without changing any real firewall during this lab.

| Source zone | Destination | Port | Expected | Reason |
|---|---|---:|---|---|
| Developer/CI | Repository edge | 443 | ALLOW | Approved package traffic |
| Developer/CI | Nexus backend | 8081 | DENY | Prevent edge bypass |
| Reverse proxy | Nexus backend private IP | 8081 | ALLOW | Backend request path |
| Public internet | Admin-only edge/path | 443 | DENY | Administration is private |
| Admin VPN/bastion | Admin edge/path | 443 | ALLOW | Privileged operations |
| Nexus backend | Required upstream registries | policy-defined | ALLOW selectively | Proxy repositories only |

The lab proves the first-order model locally. A production acceptance test should run reachability checks from actual network zones under change-control.

12. Verification checklist and evidence packet

13. Cleanup and rollback

First delete the disposable repository through Nexus supported controls, then remove the disposable publisher. Stop the proxy process. Restore the original listener configuration if it was changed for this lab and restart the disposable instance. Finally remove the exact temporary credential and certificate files.

kill "$PROXY_PID" 2>/dev/null || true
rm -f "$AUTH_FILE"
rm -f "$LAB/cert/nexus.lab.test.key" "$LAB/cert/nexus.lab.test.crt"
# Restore saved nexus.properties if changed, then restart the disposable Nexus instance.
# Remove academy-ch17-checkpoint and academy-ch17-cp-publisher in Nexus UI/API.

14. What Chapter 17 adds to the operating model

You can now document not only which repository exists and who may use it, but how requests are permitted to reach it: canonical hostname, certificate owner, reverse-proxy route, forwarded-header contract, Nexus listener/context, package/admin audience, and firewall boundary. This makes network exposure testable and recoverable rather than an implicit collection of proxy snippets.

Chapter 18 moves from exposure to lifecycle: cleanup policies, retention criteria, preview, and physical storage reclamation. The same discipline continues—policy first, evidence second, least-destructive execution third.

15. Knowledge check

Official references and version notes

• Sonatype: Run Behind a Reverse Proxy — production reverse-proxy and forwarded-header guidance.
• Sonatype: Configuring the Runtime Environment — listener and context-path configuration.
• Sonatype: Configuring SSL — inbound TLS options and certificate configuration.
• Sonatype: System Requirements — Java 21 and database/storage production guidance.