Files and repositories

This page lists where a Nexus Telemetry Fleet server and a collector keep their files on each platform, and where the packages and images come from. Each path is created by the package at install, or by the fleet server or collector at its first run.

Fleet server

Debian, Ubuntu, RHEL and Fedora

What Where Created by
Binary /usr/bin/nf-server the package
Config directory /etc/nexus-fleet, mode 0750, root:nexus-fleet the package
Environment file /etc/nexus-fleet/server.env, mode 0640, seeded from server.example.env beside it the package
Data directory /var/lib/nexus-fleet, mode 0700, nexus-fleet:nexus-fleet the package
Registry <data>/fleet.db the fleet server
Data key <data>/dek.key the fleet server
Per-organisation databases <data>/orgs/<org-id>.db, with <org-id>.dek beside each the fleet server
Certificate authority <data>/ca/. In it, ca.crt and ca.key.enc are the platform organisation’s CA certificate and its encrypted key, stream-server.crt and stream-server.key.enc are the fleet server’s own certificate and key, <org-id>/ is each organisation’s CA, and transport/ is the certificate chain collectors check the fleet server against the fleet server
Backups <data>/backups/nexus-fleet-<UTC stamp>/ nf-server backup
Last successful scheduled backup <data>/backups/.last-success the scheduled backup
Service nf-server. The unit file is /lib/systemd/system/nf-server.service from the deb and /usr/lib/systemd/system/nf-server.service from the rpm the package
Scheduled backup /usr/bin/backup-stream-to-r2.sh, /etc/nexus-fleet/backup.example.env, and the timers nf-backup, nightly, and nf-backup-check, twice a day. See Backup and restore the package
Logs none on disk. JSON to standard output, read with journalctl -u nf-server n/a

The fleet server deb leaves the service stopped and disabled after installing. The collector packages start theirs. It is enabled and started with systemctl enable --now nf-server. dpkg --purge removes /var/lib/nexus-fleet and /etc/nexus-fleet. Removing the rpm leaves both directories in place.

Docker and compose

What Where
Binary /usr/local/bin/nf-server
Data directory /var/lib/nexus-fleet, a declared volume, named nf-data by the compose files
Config environment only, no file
Ports 3000 for the dashboard, 9443 for the collector stream
Runs as uid 10001, user nexus
Logs standard output, so docker compose logs

Everything the packaged install keeps under the data directory is at the same path inside the volume.

Run by hand

The data directory is ./data in the working directory, unless NF_DATA_DIR names another. Every other path is under it.

Collector

What Debian, Ubuntu, RHEL and Fedora macOS Windows Docker
Binary /usr/bin/nf-collector /usr/local/bin/nf-collector, with nf-collector-uninstall beside it C:\Program Files\NexusFleet\nf-collector.exe /usr/local/bin/nf-collector
Config /etc/nexus-fleet/collector.toml, mode 0640 /Library/Application Support/NexusFleet/collector.toml C:\ProgramData\NexusFleet\collector.toml none, environment only
Data directory /var/lib/nexus-fleet /Library/Application Support/NexusFleet C:\ProgramData\NexusFleet /var/lib/nexus-fleet, the nf-data volume
Local store <data>/collector.db <data>/collector.db <data>\collector.db <data>/collector.db
Log <data>/logs/collector.log, kept to 5 files of 10 MB <data>/logs/collector.log, kept to 5 files of 10 MB. The system also writes the collector’s console output to /Library/Logs/NexusFleet/collector.log <data>\logs\collector.log, kept to 5 files of 10 MB <data>/logs/collector.log, kept to 5 files of 10 MB
Service nf-collector, and nf-collector-updater.path with its .service, which run the updates the dashboard triggers com.nexustelemetry.nf-collector, a launch daemon defined in /Library/LaunchDaemons NexusFleetCollector none. The container is restarted by Docker, with --restart always
Reading the log journalctl -u nf-collector -f tail -f /Library/Logs/NexusFleet/collector.log open the log file, or the Logs panel on the setup page docker logs nf-collector

These paths are inside every data directory, whatever the platform.

File What it is
certs/collector.crt the device certificate
certs/collector.key.enc its private key, encrypted
certs/ca.crt the CA certificate that signed it
certs/transport-root.crt the root certificate the collector checks the fleet server against when it connects
dek.key the key that decrypts the local store
device.id the collector’s identity. A collector that still has this file attaches to its existing record when it enrols again
enrolled.json the enrolment record: the collector id, the fleet server address and the interval
status.json the status file the running collector writes, which nf-collector status reads

Run by hand, the collector uses ./data in the working directory unless NF_DATA_DIR names another.

Note: the Linux packages create /var/log/nexus-fleet and give the service write access to it, and nothing writes there. The log is <data>/logs/collector.log.

Repositories, channels and images

Fact Value
Download host https://fleet-downloads.nexustelemetry.com
Repository signing key, served from the marketing site https://nexustelemetry.com/nexustelemetry-public.asc
Image signing key, for cosign https://nexustelemetry.com/cosign.pub
Local keyring path /usr/share/keyrings/nexustelemetry.gpg
apt source file /etc/apt/sources.list.d/nexustelemetry-fleet.list
apt source line deb [signed-by=/usr/share/keyrings/nexustelemetry.gpg] https://fleet-downloads.nexustelemetry.com/apt stable main
rpm repository file /etc/yum.repos.d/nexustelemetry-fleet.repo
rpm base URL https://fleet-downloads.nexustelemetry.com/rpm/stable/, with gpgcheck and repo_gpgcheck both on
Channels alpha, beta, stable
Registry registry.nexustelemetry.com
Collector image registry.nexustelemetry.com/nf-collector, amd64 and arm64, anonymous pull, cosign-signed
Fleet server image registry.nexustelemetry.com/nf-server, amd64 and arm64, cosign-signed
Image tags :<version>, fixed to that release. :alpha, :beta and :latest point at the newest release on the alpha, beta and stable channels
Compose files Rendered and served on Install, not on the download host: docker-compose.production.yml with Caddyfile beside it for the TLS reverse proxy, and docker-compose.yml for the plain HTTP path
macOS package NexusFleetCollector-<version>.pkg
Windows installer NexusFleetCollector-<version>.msi
deb <package>_<version>-1_<arch>.deb. In the version, a pre-release hyphen such as 0.0.1-alpha.25 is written as a tilde, 0.0.1~alpha.25
rpm <package>-<version>-<release>.<arch>.rpm, with the same tilde

A release is built and signed once. Promotion publishes the same files to the next channel and moves the image tag to the same image. Nothing is rebuilt.

Release paths

Path Contains
https://fleet-downloads.nexustelemetry.com/fleet/<channel>/<version>/ Every file of that release, with SHA256SUMS and its signature. Never changed once written
https://fleet-downloads.nexustelemetry.com/fleet/<channel>/latest.json The manifest: the current version, and each file’s address and SHA-256. Rewritten on every publish and promotion
https://fleet-downloads.nexustelemetry.com/apt/dists/<channel>/, https://fleet-downloads.nexustelemetry.com/apt/pool/ The apt repository
https://fleet-downloads.nexustelemetry.com/rpm/<channel>/packages/, .../repodata/ The rpm repository

There is no latest directory. https://fleet-downloads.nexustelemetry.com/fleet/<channel>/current/ holds the macOS package and the Windows installer without a version in the name, each beside a .sha256 file with its checksum and version, so a download link never changes. The fleet server’s update check and the collector’s update both read the manifest.

See Release channels for which channel a collector follows and how to change it, and Server updates for the fleet server.

← Alert rules and webhook Roles and permissions →