Terraform Provider for Sonatype Nexus

The signing block is required for hosted APT repositories to enable PGP signing.

Important Security and State Notes:

• passphrase: This value is sensitive and will never be returned from the Nexus API. When Terraform reads the resource, it uses the value from the local state file. Consequently, external changes to the passphrase will not be detected.
• keypair: This expects an armored private key (e.g., generated via gpg --export-secret-key --armor). If the passphrase is unset or empty, the Nexus API will not return the keypair. Like the passphrase, the keypair is read from the local state during refresh, meaning external changes to the keypair will not be detected.

signing {
  keypair    = "<armored_private_key>"
  passphrase = "<passphrase>"
}

Maven proxy repositories use two types of caching:

Proxy Caching

Configured in the proxy block. Defines how long artifacts and metadata are cached from the remote source.

• remote_url (Required): The location of the remote repository.
• content_max_age (Optional): Minutes to cache artifacts before rechecking the remote.
• metadata_max_age (Optional): Minutes to cache metadata before rechecking the remote.

Negative Cache

Configured in the negative_cache block. Handles caching of '404 Not Found' responses to prevent repeated failed requests to the remote.

• enabled (Required): Whether to cache responses for content not present in the proxied repository.
• ttl (Required): How long to cache the 'not found' status in minutes.

To prevent passwords from being saved in your Terraform state file, use the password_wo (write-only) argument instead of password.

When using password_wo, you must also provide the password_wo_version argument. To trigger a password update, increment the password_wo_version value. This pattern is particularly useful when integrating with ephemeral values (like random_password) to ensure credentials are not persisted in state.

resource "nexus_security_user" "user_password_wo" {
  userid              = "user_password_wo"
  firstname           = "Administrator"
  lastname            = "User"
  email               = "nexus1@example.com"
  password_wo         = "admin123"   # This password value isn't saved to state
  password_wo_version = 1            # Increment version to force update
  roles               = ["nx-admin"]
  status              = "active"
}

The provider features have specific Nexus Repository version requirements:

• nexus_capability: Requires Nexus Repository 3.85.0 or later (Capabilities REST API introduced in 3.84.0).
• nexus_security_oidc and data.nexus_security_oidc: Requires Nexus Repository Pro 3.93.0 or later.

For OIDC features, the Nexus instance must be configured with the following in nexus.properties:

• nexus.security.oauth2.enabled=true
• nexus.jwt.enabled=true

Additionally, the OAuth2Realm must be active (managed via nexus_security_realms).

The nexus_script resource allows you to create and execute custom scripts within Nexus. You must provide the script's content and a unique name. You can optionally specify a type for the script, which defaults to groovy if not provided.

resource "nexus_script" "repo_pypi_internal" {
  name    = "create-repo-pypi-internal"
  type    = "groovy"
  content = "repository.createPyPiHosted('pypi-internal')"
}

Use the nexus_repository_go_proxy resource to create a Go proxy repository in Nexus. This resource requires configuration for storage, proxy settings, negative caching, and HTTP client behavior.

resource "nexus_repository_go_proxy" "golang_org" {
  name   = "golang-org"
  online = true

  storage {
    blob_store_name                = "default"
    strict_content_type_validation = true
  }

  proxy {
    remote_url       = "https://proxy.golang.org/"
    content_max_age  = 1440
    metadata_max_age = 1440
  }

  negative_cache {
    enabled = true
    ttl     = 1440
  }

  http_client {
    blocked    = false
    auto_block = true
  }
}

You can import an existing PyPI hosted repository into your Terraform state using the repository name.

# import using the name of repository
terraform import nexus_repository_pypi_hosted.internal pypi-internal

You can import an existing raw proxy repository into your Terraform state using the repository name.

terraform import nexus_repository_raw_proxy.raw_org raw-org

# import using the name of repository
terraform import nexus_repository_raw_proxy.raw_org raw-org

The nexus_security_ssl data source allows you to retrieve an SSL certificate from an external host via Nexus.

Important Note: This data source retrieves certificates from external hosts; it does NOT retrieve certificates from the Nexus truststore itself.

data "nexus_security_ssl" "ldap_cert" {
  host = "google.de"
  port = 443
}

When adding or updating resources or data sources, update the corresponding examples in ./examples/resources/<name> or ./examples/data-sources/<name>. Then, use the following command to generate the documentation from the Go source files:

make docs

You can import an existing Maven hosted repository into your Terraform state using the repository's name.

terraform import nexus_repository_maven_hosted.releases maven-releases

Use the nexus_repository_pypi_hosted resource to create and manage a hosted PyPI repository in Nexus. You must provide a unique name and a storage configuration block.

resource "nexus_repository_pypi_hosted" "internal" {
  name   = "pypi-internal"
  online = true

  storage {
    blob_store_name                = "default"
    strict_content_type_validation = true
    write_policy                   = "ALLOW"
  }
}