How to Configure a External LB for Nexus Instance

Terminology

Scenario Description

Typically, when deploying a Nexus instance via a domain name, the domain certificate is configured on the cluster LB. However, if you want to configure the domain certificate on the external LB (such as f5), additional configuration is required.

Common scenarios:

1. Deploy Nexus via NodePort, then forward traffic to the NodePort through the external LB.
2. Deploy Nexus via domain name (HTTP), then forward traffic to the cluster LB through the external LB, and finally the cluster LB forwards it to the Nexus service.

Configuration Method

There are various types of load balancers, but their principles and configuration methods are similar. You only need to set the HTTP Headers correctly when the load balancer forwards the traffic. The required HTTP Headers are shown in the table below:

Below is the configuration process through an actual case, for example, to access the Nexus tool UI page via the domain https://nexus.example.cn and download dependencies normally.

Scenario 1: Configure External LB to Forward to Nexus Service’s NodePort Service

Prerequisites

1. Nexus has been deployed via NodePort.
2. Nexus service can be accessed via http://<node-ip>:<node-port> (e.g., http://192.168.1.100:30000).

Modify Nexus Instance Access Address

1. In the left navigation bar, click Toolchain Management > Instance Management.
2. Edit the corresponding Nexus instance and change the URL to https://nexus.example.cn.

Configure External LB

Take Nginx configuration as an example, set the forwarding address to the NodePort address corresponding to the Nexus service:

server {
    listen 443 ssl;
    server_name https://nexus.example.cn;

    # SSL configuration
    ssl_certificate /etc/nginx/certs/domain.pem;
    ssl_certificate_key /etc/nginx/certs/domain.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        # Set the forwarding address to the NodePort address corresponding to the Nexus service
        proxy_pass http://192.168.1.100:30000;
        proxy_set_header Host $host;
        proxy_redirect   off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name:$server_port;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

Test Verification

Access https://nexus.example.cn in the browser, you should be able to access the Nexus service UI page and download dependencies normally.

Scenario 2: Configure External LB to Forward to Cluster LB

Prerequisites

1. Nexus has been deployed via Ingress with HTTP protocol.
2. The cluster where Nexus is located has already configured a cluster LB, and it can be accessed externally through the IP bound to the cluster LB (e.g., http://192.168.100.10:80).

Modify Nexus Instance Access Address

1. In the left navigation bar, click Toolchain Management > Instance Management.
2. Edit the corresponding Nexus instance.
   • Change the Domain to nexus.example.cn.
   • Change the Protocol to HTTP.
   • Change the URL to https://nexus.example.cn.

Configure External LB

Take Nginx configuration as an example, set the forwarding address to the IP address corresponding to the cluster LB:

server {
    listen 443 ssl;
    server_name https://nexus.example.cn;

    # SSL configuration
    ssl_certificate /etc/nginx/certs/domain.pem;
    ssl_certificate_key /etc/nginx/certs/domain.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        # Set the forwarding address to the IP address of the cluster LB
        proxy_pass http://192.168.100.10;
        proxy_set_header Host $host;
        proxy_redirect   off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name:$server_port;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

Test Verification

Access https://nexus.example.cn in the browser, you should be able to access the Nexus service UI page page and download dependencies normally.