如何自动化Nexus Docker容器的任务创建与匿名访问禁用？

一、自动化禁用匿名访问 #

利用Nexus的Groovy脚本API实现，结合你已开启的nexus.scripts.allowCreation=true配置，可直接通过API提交并执行脚本：

1. 编写禁用匿名的Groovy脚本 #

import org.sonatype.nexus.security.SecuritySystem

def security = container.lookup('org.sonatype.nexus.security.SecuritySystem')
def anonymousConfig = security.configuration.getAnonymousConfiguration()
anonymousConfig.setEnabled(false)
security.configuration.setAnonymousConfiguration(anonymousConfig)
security.saveConfiguration()

return "Anonymous access disabled"

2. 提交并执行脚本 #

方式一：使用curl调用REST API

# 提前设置管理员账号密码（因你已关闭随机密码，可预设）
ADMIN_USER="admin"
ADMIN_PASS="your-admin-password"
NEXUS_URL="http://your-nexus-host:8081"

# 创建脚本
curl -X POST -u "${ADMIN_USER}:${ADMIN_PASS}" "${NEXUS_URL}/service/rest/v1/script" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "disable-anonymous",
    "type": "groovy",
    "content": "import org.sonatype.nexus.security.SecuritySystem\ndef security = container.lookup('\''org.sonatype.nexus.security.SecuritySystem'\'')\ndef anonymousConfig = security.configuration.getAnonymousConfiguration()\nanonymousConfig.setEnabled(false)\nsecurity.configuration.setAnonymousConfiguration(anonymousConfig)\nsecurity.saveConfiguration()\nreturn \"Anonymous access disabled\""
  }'

# 执行脚本
curl -X POST -u "${ADMIN_USER}:${ADMIN_PASS}" "${NEXUS_URL}/service/rest/v1/script/disable-anonymous/run"

方式二：使用Nexus CLI

# 创建脚本
nexus scripts create --name disable-anonymous --type groovy --content "import org.sonatype.nexus.security.SecuritySystem\ndef security = container.lookup('\''org.sonatype.nexus.security.SecuritySystem'\'')\ndef anonymousConfig = security.configuration.getAnonymousConfiguration()\nanonymousConfig.setEnabled(false)\nsecurity.configuration.setAnonymousConfiguration(anonymousConfig)\nsecurity.saveConfiguration()\nreturn \"Anonymous access disabled\""

# 执行脚本
nexus scripts run disable-anonymous

二、自动化创建任务（以清理任务为例） #

同样通过Groovy脚本API实现，可自定义任务类型、调度规则与关联资源：

1. 编写创建清理任务的Groovy脚本 #

替换脚本中的your-cleanup-policy-id、your-repo-name为你已创建的资源ID/名称，调整Cron表达式以匹配调度需求：

import org.sonatype.nexus.scheduling.TaskConfiguration
import org.sonatype.nexus.scheduling.TaskScheduler
import org.sonatype.nexus.scheduling.schedule.CronSchedule

def taskScheduler = container.lookup(TaskScheduler.class.name)
// 指定任务类型：repository.cleanup为清理任务，可替换为其他类型（如maven.proxy-sync等）
def taskConfig = taskScheduler.createTaskConfigurationInstance("repository.cleanup")

// 配置任务基础信息
taskConfig.setName("Daily Repository Cleanup")
taskConfig.setDescription("Auto-clean stale assets daily at 2 AM")
taskConfig.setEnabled(true)

// 关联已创建的清理策略与仓库
taskConfig.setString("cleanupPolicyId", "your-cleanup-policy-id")
taskConfig.setString("repositoryName", "your-repo-name")

// 设置Cron调度规则（每天凌晨2点执行）
def cronSchedule = taskScheduler.scheduleFactory.cron("0 0 2 * * ?")
taskScheduler.scheduleTask(taskConfig, cronSchedule)

return "Cleanup task created successfully"

2. 提交并执行脚本 #

方式一：使用curl调用REST API

ADMIN_USER="admin"
ADMIN_PASS="your-admin-password"
NEXUS_URL="http://your-nexus-host:8081"

# 创建脚本
curl -X POST -u "${ADMIN_USER}:${ADMIN_PASS}" "${NEXUS_URL}/service/rest/v1/script" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "create-cleanup-task",
    "type": "groovy",
    "content": "import org.sonatype.nexus.scheduling.TaskConfiguration\nimport org.sonatype.nexus.scheduling.TaskScheduler\nimport org.sonatype.nexus.scheduling.schedule.CronSchedule\ndef taskScheduler = container.lookup(TaskScheduler.class.name)\ndef taskConfig = taskScheduler.createTaskConfigurationInstance(\"repository.cleanup\")\ntaskConfig.setName(\"Daily Repository Cleanup\")\ntaskConfig.setDescription(\"Auto-clean stale assets daily at 2 AM\")\ntaskConfig.setEnabled(true)\ntaskConfig.setString(\"cleanupPolicyId\", \"your-cleanup-policy-id\")\ntaskConfig.setString(\"repositoryName\", \"your-repo-name\")\ndef cronSchedule = taskScheduler.scheduleFactory.cron(\"0 0 2 * * ?\")\ntaskScheduler.scheduleTask(taskConfig, cronSchedule)\nreturn \"Cleanup task created successfully\""
  }'

# 执行脚本
curl -X POST -u "${ADMIN_USER}:${ADMIN_PASS}" "${NEXUS_URL}/service/rest/v1/script/create-cleanup-task/run"

方式二：使用Nexus CLI

# 创建脚本
nexus scripts create --name create-cleanup-task --type groovy --content "import org.sonatype.nexus.scheduling.TaskConfiguration\nimport org.sonatype.nexus.scheduling.TaskScheduler\nimport org.sonatype.nexus.scheduling.schedule.CronSchedule\ndef taskScheduler = container.lookup(TaskScheduler.class.name)\ndef taskConfig = taskScheduler.createTaskConfigurationInstance(\"repository.cleanup\")\ntaskConfig.setName(\"Daily Repository Cleanup\")\ntaskConfig.setDescription(\"Auto-clean stale assets daily at 2 AM\")\ntaskConfig.setEnabled(true)\ntaskConfig.setString(\"cleanupPolicyId\", \"your-cleanup-policy-id\")\ntaskConfig.setString(\"repositoryName\", \"your-repo-name\")\ndef cronSchedule = taskScheduler.scheduleFactory.cron(\"0 0 2 * * ?\")\ntaskScheduler.scheduleTask(taskConfig, cronSchedule)\nreturn \"Cleanup task created successfully\""

# 执行脚本
nexus scripts run create-cleanup-task

注意事项 #

• 确保Docker启动时已预设管理员密码（可通过环境变量NEXUS_ADMIN_PASSWORD注入），避免执行脚本时因认证失败报错
• 若需在容器启动时自动执行这些操作，可编写启动脚本，使用wait-for-it等工具等待Nexus API端口就绪后再执行curl/CLI命令
• 任务类型可根据需求替换，比如maven.proxy-sync用于代理仓库同步，docker.gc用于Docker仓库垃圾回收等，具体类型可参考Nexus内置任务列表

内容的提问来源于stack exchange，提问作者SriSiva