Deploy and Host Nexus Repository on Railway

Built for an LLM agent to deploy and use. There is nothing to fill in: the admin password is generated at deploy time, anonymous access is off, all state sits on one volume, and the contract below lists every URL and variable name with one script that checks health, auth, a Maven upload and a download.

Nexus Repository is an artifact repository manager: it hosts and proxies Maven, npm, PyPI, NuGet, Docker, Helm, raw files and more, so builds fetch dependencies from your own server and publish their results to it. This template runs Sonatype Nexus Repository Community Edition 3.97 as one service with its embedded database, so it needs no PostgreSQL or Redis.

About Hosting Nexus Repository

This template runs one service, built from the official sonatype/nexus3 3.97.3 image (pinned by digest) in the public wrapper bon5co/nexus-railway, with the volume at /nexus-data. The wrapper fixes the ownership of the root-owned mount for the service user, makes Jetty listen on the port Railway injects on both IPv4 and IPv6 (so the private network works), and sizes the JVM heap and direct memory from the container memory limit instead of the host's RAM. Set NEXUS_HEAP_MB or NEXUS_DIRECT_MB to override. The admin password is the generated variable NEXUS_SECURITY_INITIAL_PASSWORD, applied on the first boot; anonymous access is disabled.

Things to know before you rely on it:

Licence step. The Community Edition refuses to store or serve components until its End User License Agreement is accepted. This template does not accept it for you. The script below shows the one REST call that records the acceptance as your own decision; read the agreement at https://links.sonatype.com/products/nxrm/ce-eula first.
Community limits. 40,000 components and 100,000 requests per day; past either, adding new components pauses.
Memory. Sonatype recommends 4 GB of RAM or more. A small Railway plan runs it with a small heap; give it a plan with at least 4 GB for real use.
One port. Only the web and REST port is public, so Maven, npm, PyPI and raw repositories work through the domain. A Docker registry needs its own connector port, which a single Railway domain does not expose.

Agent contract

Public URL: https://RAILWAY_PUBLIC_DOMAIN of the nexus service (set NEXUS_URL to it, no trailing slash)
Private URL: http://nexus.railway.internal:8080
Credentials: user admin, password in NEXUS_SECURITY_INITIAL_PASSWORD (on the nexus service)
Auth: HTTP basic auth with that user and password on /service/rest/* and /repository/*; anonymous calls get 401
Health: GET /service/rest/v1/status returns 200 with no credentials (about 30 seconds after start; GET / also returns 200)

# run with NEXUS_URL and NEXUS_SECURITY_INITIAL_PASSWORD (nexus service); needs curl and sed
A="admin:$NEXUS_SECURITY_INITIAL_PASSWORD"
echo "status: $(curl -s -o /dev/null -w '%{http_code}' "$NEXUS_URL/service/rest/v1/status")"
echo "anonymous read: $(curl -s -o /dev/null -w '%{http_code}' "$NEXUS_URL/service/rest/v1/repositories")"
echo "admin read: $(curl -s -o /dev/null -w '%{http_code}' -u "$A" "$NEXUS_URL/service/rest/v1/repositories")"
# the Community EULA is a licence you accept; this call is that acceptance, run it only if you agree
D=$(curl -s -u "$A" "$NEXUS_URL/service/rest/v1/system/eula" | sed -n 's/.*"disclaimer" : "\(.*\)".*/\1/p')
echo "eula accept: $(curl -s -o /dev/null -w '%{http_code}' -u "$A" -X POST "$NEXUS_URL/service/rest/v1/system/eula" -H 'Content-Type: application/json' -d "{\"accepted\":true,\"disclaimer\":\"$D\"}")"
echo "upload: $(curl -s -o /dev/null -w '%{http_code}' -u "$A" -T /etc/hostname "$NEXUS_URL/repository/maven-releases/demo/hello/1.0/hello-1.0.txt")"
echo "download: $(curl -s -o /dev/null -w '%{http_code}' -u "$A" "$NEXUS_URL/repository/maven-releases/demo/hello/1.0/hello-1.0.txt")"
echo "anonymous download: $(curl -s -o /dev/null -w '%{http_code}' "$NEXUS_URL/repository/maven-releases/demo/hello/1.0/hello-1.0.txt")"

A fresh deploy prints status: 200, anonymous read: 401, admin read: 200, eula accept: 204, upload: 201, download: 200 and anonymous download: 401. The default repositories are maven-central, maven-releases, maven-snapshots, maven-public, nuget.org-proxy, nuget-hosted and nuget-group. Create npm, PyPI, raw or other repositories with POST /service/rest/v1/repositories/{format}/{type}, and the full API is described at /service/rest/swagger.json.

Why Deploy Nexus Repository on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Nexus Repository on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Agent-ready - generated admin password, a contract block and one working script; no setup screen to click through.
Closed by default - anonymous access is off, so unauthenticated reads and writes are refused.
One service - the embedded database means no PostgreSQL or Redis to run beside it.
State survives redeploys - repositories, blobs and the admin password live on the volume and stay the same after every redeploy.

Common Use Cases

Private Maven repository - publish internal libraries with mvn deploy and proxy Maven Central so builds are faster and repeatable.
npm and PyPI proxy - cache public packages and host private ones behind one login.
Build artifact store - keep CI outputs, release zips and raw files with retention rules and an API an agent can drive.

Dependencies for Nexus Repository Hosting

A volume at /nexus-data (included in this template).

Deployment Dependencies

Sonatype Nexus Repository - upstream project
bon5co/nexus-railway - the wrapper image this template deploys, built from sonatype/nexus3 3.97.3