Nexspence

Free, open-source universal artifact repository manager

A full-featured self-hosted alternative to Sonatype Nexus Repository

Nexspence is a self-hosted artifact repository manager that supports 15 package formats, three repository types (hosted, proxy, group), fine-grained RBAC, SSO via OIDC/LDAP, audit logging, S3-compatible storage, and a modern dark-theme web UI — all in a single Go binary backed by PostgreSQL.

It exposes the full Sonatype Nexus v1 REST API at /service/rest/v1/, so existing CI/CD pipelines and package manager configs keep working after a migration. Live migration from a running Nexus instance — repositories, artifacts, container images, users, roles and routing rules — is built in, pausable and restart-safe.

git clone https://github.com/nexspence/nexspence
cd nexspence
docker compose up -d

Web UI and REST API at http://localhost:8081 (admin / admin123 — change it right after the first login), Docker registry at localhost:5001.

Kubernetes, HA clusters, S3 storage and OIDC SSO: nexspence.com/docs

Maven · npm · PyPI · Go modules · Docker · OCI artifacts · NuGet · Helm · Cargo · APT · Yum/RPM · Conan · Conda · Terraform Registry · Raw

Each of them as a hosted repository, a caching proxy, or a group that merges several repositories under one URL.

Repositories — 15 formats, three types	Browse — image tree with asset metadata
OCI — Helm charts, ORAS artifacts, signatures	Vulnerability dashboard — Trivy + OSV
Cleanup policies on a cron schedule	Monitoring — requests, errors, storage

• OCI registry — container images, Helm charts pushed with helm push oci://, ORAS artifacts and cosign signatures, with the Referrers API for SBOM and attestation discovery
• Security — local accounts, LDAP/AD, OIDC SSO (Keycloak, Google, Entra ID, Okta), API tokens, RBAC with CEL content selectors
• Storage — local filesystem or S3-compatible (AWS S3, MinIO, Ceph), per-repository routing, blob store groups, quotas
• Operations — HA with stateless nodes and Redis locks, cleanup policies on a cron schedule, backup/restore, content replication, signed webhooks, audit log
• Monitoring — Prometheus /metrics and a pre-built Grafana dashboard
• Vulnerability scanning — Trivy for container images, OSV.dev for Maven, npm, PyPI and Cargo

Issues, feature requests and pull requests are welcome in the individual repositories. Questions and release announcements live in the Telegram channel: @nexspence_community