Immutable Infrastructure as Artifacts: Nexus as a Single Point of Control

Keeping promises is hard. One way to help that is to reduce the breadth of your promises.

Our promise to the organization is that we will only deliver from Nexus and that everything that goes into Nexus is permanent. That Includes app code, infra code, and data.

Our company and team works within the OKR/MBI methodology, but promises go deeper than that. They’re a means by which we make it possible for others to predict our actions, and allow them to perform proper planning.

But as hard as it is to keep a promise, it’s apparently even harder to make the right ones. Our team has distilled our promises down to effectively one set of statements: “We will never throw away things that make it through our process and the repository for all our processes is Nexus.”

Since we’re primarily a JVM shop, this seems trivial at the application code level – builds just deploy to Nexus like thousands of other companies. But our commitment goes a bit deeper than that. We package infrastructure artifacts via our build and release process and the results also go into Nexus. We build and release data objects as versioned artifacts into Nexus.

Finally and most importantly, we do deliveries of our systems directly from Nexus.

While this does make the paths that developers can travel down to get their code into production more restrictive, we have found that such restrictions allow for greater reliability and security. All of our code gets tested as part of its build and release, including infrastructure, and thus we have both high confidence as well as means to remediate errors.

Relevance: Our only promise is that we will never delete a release from our artifact repositories (i.e. nexus, and that is also barring data-retention requirements). Since literally everything we care about gets built as an artifact, this means that our promise is exceptionally broad and pretty easy to keep.