I am running a Nexus Docker Registry with a HTTP connector behind an Apache reverse proxy.
The setup is pretty much the one recommended by Sonatype.
Communication looks like this:
docker pull ---> https://my-registry-server:10443 (Apache) ---> http://127.0.0.1:10080 (Nexus)
This has always worked fine, also for anonymous docker pull requests requiring the Docker Bearer Token. But after upgrading to Nexus 3.80.0-06 anonymous access stopped working and debugging showed, that the WWW-Authenticate Header sent back from Nexus had a bad token URL like this:
Bearer realm="https://my-registry-server:10443:10443/v2/token",service="https://my-registry-server:10443:10443/v2/token"
Nexus seems to construct the URL from the X-Forwarded-* Headers and I played around with them by setting ProxyAddHeaders off and then individual values for 'RequestHeader set X-Forwarded-XX "..", but without success.
I ended up overwriting the “WWW-Authenticate” header created by Nexus in all responses like this:
Header set WWW-Authenticate 'Bearer realm="https://my-registry-server:10443/v2/token"'
Although that works, it feels a little blunt. Did anybody experience the same problem?
I have another nexus running in a test stage on 3.82.0-08, but that shows the same behaviour.
BR,
Dirk