---
title: Nexus
scope: 3dmk
type: documentation
subject: nexus
group: Systems
status: current
version: "2.1.3"
source: https://3dmk.com/documentation#nexus
author: Nick Olson
contact:
  email: 3dmk@3dmk.com
  site: https://3dmk.com
license: CC BY 4.0
license_url: https://creativecommons.org/licenses/by/4.0/
attribution: Nick Olson, 3dmk.com
---

# Nexus

Nexus is the package registry for every project in the stack. It runs Sonatype Nexus Repository, an off-the-shelf product. Every build resolves its dependencies through Nexus, and every internal library publishes to it. Builds draw from one known source instead of whatever the public registries serve at the time.

## Role

Nexus stands between the builds and the public package registries. It hosts private packages and proxies public ones. A proxy repository keeps a local copy of each public package after its first request. No project reads from a public registry directly.

Nexus also feeds security monitoring. Two checks compare its cached packages against the Open Source Vulnerabilities (OSV) database. A flagged version marks a library to update or to remove from the build.

## Parts

Each language gets three kinds of repository. Python, JavaScript, and Rust each have the full set. Other ecosystems follow the same pattern. Each kind of repository has one job.

| Repository kind | Holds | Used by |
|---|---|---|
| Group | One address that joins the proxy and hosted repositories | Every project build |
| Proxy | Cached copies of packages from a public registry | The group and the vulnerability checks |
| Hosted | Internal packages built in the stack | The group and internal library uploads |

Projects configure only the group. Machine-level settings send every package install through it. The Core bootstrap creates the default repositories for each language when Nexus starts. It records their addresses in Consul. It also registers Nexus as a service.

## Data

Nexus stores package files and the metadata that describes them. Each component carries a name and a version. Hosted repositories keep the internal releases. Proxy repositories keep every public package that a build has requested. That cache is the set of components the security checks scan.

## Connections

Nexus exchanges packages, addresses, and findings with the systems in this table.

| System | What passes |
|---|---|
| Project builds | Package requests go to the group. Packages return from the hosted or proxy repository. |
| Publishing | Release builds install JavaScript packages through the group. |
| Consul | Nexus registers as a service. The bootstrap stores the repository addresses as settings. |
| Vault | Vault holds the credentials for uploads to hosted repositories. |
| NervHQ | A collector lists the components. It checks proxy packages against OSV data. Redis caches the results for the dashboard. |
| Seele | An agent job scans the proxy cache against OSV. It records the blocked versions for each language in Seele. |