Skip to content
SPECIFICTION
Get listed

Nexspence

nexspence.com

From $5/mo Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit nexspence.com
Spec score 9.0 #2 of 64 in Artifact repository software

What it is

Nexspence is a self-hosted artifact repository manager positioned as a replacement for other artifact repository managers. It supports 15 formats, including Maven, Docker, npm, PyPI, Go Modules, NuGet, Helm, Cargo, Apt, Yum, Conan, Raw, Conda, and Terraform. Hosted, Proxy, and Group repository types are available across formats, with format-specific exceptions. A one-command migration streams repositories, users, and artifacts from a live Nexus instance and is described as pausable and conflict-safe. Storage can use MinIO, AWS S3, Wasabi, or a local filesystem, with per-repository blob-store assignment. Identity options include OIDC/SSO providers, just-in-time provisioning, and group-to-role mapping. Security controls include LDAP, API tokens, JWT, fine-grained RBAC, and SSRF-protected outbound fetches. OSV.dev scanning covers Maven, npm, PyPI, and Cargo; Docker and OCI scanning requires an operator-supplied Trivy installation. Deployment options include Docker Compose, Helm/Kubernetes, and native packages or archives for Linux, macOS, and Windows. Nexspence is free at free and licensed under GNU AGPL v3 or later.

Spec sheet

What it does
Nexspence is a self-hosted universal artifact repository manager intended as a drop-in alternative to commercial repository managers.Read 15 Oct 2026 · nexspence.com
Product
Nexspence is a self-hosted artifact repository manager intended as a drop-in replacement for other artifact repository managers.Read 4 Oct 2026 · nexspence.com
Deployment
Deployment options include Docker Compose, Helm/Kubernetes, and native packages or archives for Linux, macOS, and Windows.Read 4 Oct 2026 · nexspence.com
Support
The project directs users to Telegram for release and setup questions, GitHub issues for bugs and feature requests, and direct maintainer contact for private matters.Read 15 Oct 2026 · nexspence.com
License
The site states Nexspence is licensed under GNU AGPL v3 or later.Read 4 Oct 2026 · nexspence.com
Architecture
An independent Habr article describes a Go/Gin backend, React/TypeScript frontend, PostgreSQL metadata storage and a single static binary.Read 15 Oct 2026 · habr.com
Artifact formats
The website lists 15 supported formats, including Maven, npm, Docker, PyPI, Go, NuGet, Helm, Cargo, Apt, Yum/RPM, Conan, Raw, Conda and Terraform.Read 15 Oct 2026 · nexspence.com
Audit logging
The product keeps a 90-day audit trail with date and user filters and NDJSON streaming export.Read 15 Oct 2026 · nexspence.com
Audit logs
Audit logs have 90-day retention and support NDJSON streaming export.Read 4 Oct 2026 · nexspence.com
Authorization
RBAC uses roles, privileges and CEL content selectors for path-level repository permissions.Read 15 Oct 2026 · nexspence.com
Cleanup policies
Automated cleanup can use maximum age, last-download thresholds or retain-N-versions rules scheduled by cron.Read 15 Oct 2026 · nexspence.com
CLI
The project publishes a separate Go command-line tool named nxs for Nexspence administration.Read 15 Oct 2026 · github.com
Documentation
The documentation covers installation, high availability, SSO, repositories, format guides, RBAC, webhooks, migration, monitoring, promotion, replication and REST APIs.Read 15 Oct 2026 · nexspence.com
Funding model
GitHub Sponsors states that sponsorship funds infrastructure, CI and development while the software remains AGPLv3 and free.Read 15 Oct 2026 · github.com
Identity integrations
Built-in OIDC/OAuth2 SSO supports Keycloak, Google, Microsoft Entra ID and Okta, with JIT provisioning and group-to-role mapping.Read 15 Oct 2026 · nexspence.com
Infrastructure as code
The official Terraform provider manages repositories, blob stores, users, roles, privileges, cleanup policies, webhooks, and promotion rules.Read 4 Oct 2026 · nexspence.com
Install options
Deployment options include Docker Compose, Helm/Kubernetes, Linux deb or rpm packages, macOS archives with launchd and Windows service packages.Read 15 Oct 2026 · nexspence.com
LDAP
LDAP and Active Directory authentication include just-in-time user creation and group-to-role mapping.Read 15 Oct 2026 · nexspence.com
Limit: database dependency
The native single-binary installation still requires an external PostgreSQL database.Read 15 Oct 2026 · nexspence.com
Limit: disclosed security issues
The v2.9.2 release documented five security fixes, including a critical exposure of Apt signing credentials and several high-severity authorization issues.Read 15 Oct 2026 · github.com
Limit: Trivy dependency
Docker and OCI image scanning is unavailable until the operator supplies and configures a separate Trivy binary.Read 15 Oct 2026 · nexspence.com
Limit: webhook delivery
Webhook delivery is fire-and-forget and failed deliveries are not retried, so critical consumers need their own durable queue.Read 15 Oct 2026 · nexspence.com
Migration
A one-command migration streams repositories, users, and artifacts from a live Nexus instance and is described as pausable and conflict-safe.Read 4 Oct 2026 · nexspence.com
Nexus compatibility
Nexspence exposes a Nexus-compatible v1 REST API under /service/rest/v1/.Read 15 Oct 2026 · github.com
Nexus migration
A live migration tool streams repositories, users and artifacts from Nexus with pause and resume support.Read 15 Oct 2026 · nexspence.com
Praise: migration and compatibility
The Habr review praises changing only the host URL because existing CI/CD tools continue working through Nexus REST API compatibility.Read 15 Oct 2026 · habr.com
Praise: resource usage
The Habr review reports roughly 60–80 MB RAM for Nexspence in its described setup, versus 1.5–2 GB for Nexus in the author's comparison.Read 15 Oct 2026 · habr.com
Promotion
Staging and build-promotion workflows provide CEL filters, vulnerability-scan gates and manual approval queues.Read 15 Oct 2026 · nexspence.com
Provider release
The Terraform provider repository lists v0.2.0 as its latest release, dated 8 June 2026.Read 15 Oct 2026 · github.com
Release news
Version 2.11.0 was released on 12 October 2026 with Apt metadata generation, hosted-member precedence in groups and earlier routing-rule evaluation.Read 15 Oct 2026 · github.com
Replication
Content replication pushes artifacts to remote Nexspence instances on a schedule and encrypts credentials with AES-256-GCM.Read 15 Oct 2026 · nexspence.com
Repository activity
The public GitHub repository showed 30 stars, 7 forks and 1,060 commits when opened.Read 15 Oct 2026 · github.com
Repository modes
Each format can be provided as hosted, proxy or group repositories, although some formats support fewer modes.Read 15 Oct 2026 · nexspence.com
Repository types
The site says every format supports Hosted, Proxy, and Group repository types, with some format-specific exceptions shown in its format list.Read 4 Oct 2026 · nexspence.com
Runtime requirement
The native-install section says the embedded-UI binary requires an external PostgreSQL 13 or later instance.Read 4 Oct 2026 · nexspence.com
Security controls
The site lists LDAP, API tokens, JWT, fine-grained RBAC with CEL content selectors, SSRF-protected outbound fetches, and a non-root container.Read 4 Oct 2026 · nexspence.com
Security defaults
Official security claims include non-root containers, dropped Linux capabilities, SSRF blocking, JWT revocation, refusal to start with development secrets, body-size limits and release SBOM scanning.Read 15 Oct 2026 · nexspence.com
Storage
Blob data can use local storage or S3-compatible services such as AWS S3, MinIO, Wasabi and Ceph, with per-repository routing.Read 15 Oct 2026 · nexspence.com
Storage integrations
Repositories can use MinIO, AWS S3, Wasabi, or a local filesystem, with per-repository blob-store assignment.Read 4 Oct 2026 · nexspence.com
System requirements
Native installation requires PostgreSQL 13 or newer; Helm deployment requires Helm 3 and Kubernetes 1.26 or newer.Read 15 Oct 2026 · nexspence.com
Terraform provider
An official Terraform provider manages repositories, blob stores, users, roles, selectors, cleanup policies, routing rules, webhooks and promotion rules.Read 15 Oct 2026 · github.com
Vulnerability scanning
Maven, npm, PyPI and Cargo packages are scanned with OSV.dev; Docker and OCI scanning uses a Trivy binary supplied by the operator.Read 15 Oct 2026 · nexspence.com
Webhooks
Asynchronous HMAC-signed webhooks cover artifact publication, deletion, repository events and promotion events.Read 15 Oct 2026 · nexspence.com

Plans and prices

Free forever Free All product features · No license fees · Self-hosted deployment Read 15 Oct 2026 · nexspence.com
Nexspence Free No license fees · Free forever Read 4 Oct 2026 · nexspence.com
Supporter $5 a month $5/mo GitHub sponsor badge · Name listed in SPONSORS.md · Release and roadmap newsletter Read 4 Oct 2026 · nexspence.com
Supporter $5 a month monthly GitHub sponsor badge · Name in SPONSORS.md · Release newsletter Read 15 Oct 2026 · github.com
Backer $25 a month $25/mo Everything in Supporter · Project README listing and link · Roadmap polls · Release notes thank-you Read 4 Oct 2026 · nexspence.com
Backer $25 a month monthly Supporter benefits · Name and link in README · Roadmap-poll input · Release-notes thanks Read 15 Oct 2026 · github.com
Sponsor $100 a month monthly Backer benefits · Logo and link on README and website · Priority issue triage · Maintainer deployment contact Read 15 Oct 2026 · github.com
Sponsor $100 a month $100/mo Everything in Backer · Logo and link on README and site · Priority issue triage · Direct maintainer contact for deployment questions Read 4 Oct 2026 · nexspence.com

Every Nexspence plan and price →

Strong points and limits

Strong points

  • Supports 15 artifact formats.
  • Migration can stream from a live Nexus instance.
  • Supports several identity and storage integrations.
  • Terraform provider manages repository infrastructure.
  • Free under GNU AGPL v3 or later.

Limits

  • Native installation requires external PostgreSQL 13 or later.
  • Docker and OCI scanning requires operator-supplied Trivy.
  • Audit log retention is 90 days.

Who it suits

It suits teams that want to self-host artifact repositories across multiple package formats and manage their own storage and deployment. Operators should also consider its database requirement for native installation and the Trivy requirement for Docker and OCI scanning.

Verdict

Nexspence offers broad format support, migration, and deployment choices for self-hosted repository management. Scanning coverage differs by artifact type, and native installs require an external PostgreSQL instance.

Where Specifiction places it

Alternatives to NexspenceAll alternatives →