A package for configuring Sonatype Nexus Repository Manager OSS to only allow selected packages to be installed from proxy repositories.
Supports creating CRAN and PyPI proxies which allow either all, or only named packages.
A Dockerfile and example docker compose configuration demonstrate how to use the script in conjunction with a Nexus OSS container.
Check and, if you would like, change the following environement variables for the Nexus Allowlist container in docker-compose.yaml
.
Environment variable | meaning |
---|---|
NEXUS_ADMIN_PASSWORD | Password for the Nexus OSS admin user (changes from the default on first rune then used for authentication) |
NEXUS_PACKAGES | Whether to allow all packages or only selected packages [all , selected ] |
NEXUS_HOST | Hostname of Nexus OSS host |
NEXUS_PORT | Port of Nexus OSS |
Example allowlist files are included in the repository for PyPI and CRAN. The PyPI allowlist includes numpy, pandas, matplotlib and their dependencies. The CRAN allowlist includes cli and data.table You can add more packages by writing the package names, one per line, in the allowlist files.
Start the Nexus and Nexus Allowlist containers using docker compose
docker compose up -d
You can monitor the Nexus Allowlist container instance
docker compose logs -f allowlist
The container command
- Ensures that allowlist files
/allowlists/pypi.allowlist
and/allowlists/cran.allowlist
exist - Waits for Nexus OSS to be available at
NEXUS_HOST:NEXUS_PORT
- If the Nexus OSS initial password file is present (at
/nexus-data/admin.password
) - Changes the admin password to
NEXUS_ADMIN_PASSWORD
- Runs initial configuration (creates a role, repositories, content selectors, etc.)
- Reruns the content selector configuration (which enforces the allowlists) every time either of the allowlist files are modified
Caddy acts as a reverse proxy, passing requests to the Nexus OSS server. The configuration file replaces 401 responses from Nexus OSS with 403 so that pip does not prompt a user for authentication when attempting to install a blacked package.
You can edit ~/.config/pip/pip.conf
to use the Nexus PyPI proxy.
To apply globally edit /etc/pip.conf
.
For example
[global]
index = http://localhost:8080/repository/pypi-proxy/pypi
index-url = http://localhost:8080/repository/pypi-proxy/simple
You should now only be able to install packages from the allowlist. For example,
pip install numpy
should succeedpip install mkdocs
should fail
You can edit ~/.Rprofile
to use the Nexus CRAN proxy.
To apply globally edit /etc/R/Rprofile.site
.
For example
local({
r <- getOption("repos")
r["CRAN"] <- "http://localhost:8080/repository/cran-proxy"
options(repos=r)
})
You should now only be able to install packages from the allowlist. For example,
install.packages("data.table")
should succeedinstall.packages("ggplot2")
should fail