OrientDB to Self-Hosted PostgreSQL Migration

Use this section to migrate a legacy self-hosted OrientDB instance to a self-hosted PostgreSQL instance.

Pre-Migration Setup

This section explains how to prepare the source instance, target instance and migrator before migration.

Source Instance Configuration

To migrate encrypted secrets such as passwords, tokens, and credentials, configure a cipher password on the source instance before you start the migration.

The following secrets require a cipher password:

Category	Secrets
Blob Store	S3 secret access keys, Azure storage account keys, Google Cloud service account keys
Repository	HTTP proxy passwords, remote repository credentials, Docker registry passwords, APT and Yum signing keypairs and passphrases
System	LDAP bind passwords, SAML private keys, email server passwords
User Authentication	API keys such as NuGet and npm, and user tokens

Take the following steps to generate a cipher password:

Generate a cipher password with a minimum of 24 characters.
```
openssl rand -base64 32
```
Add the cipher password to $NEXUS_DATA/etc/nexus.properties on the source instance.
```
nexus.migrator.cipher.password=<your-generated-password>
```
Restart the source OrientDB instance.

Warning

If you do not configure a cipher password, the migrator does not migrate sensitive data such as passwords, tokens, or S3 credentials. You must then reconfigure those values manually on the target instance.

To migrate local users, you may also need to add the nexus.user.configuration.source.enabled=true entry to $NEXUS_DATA/etc/nexus.properties on the source instance.

Target Instance Configuration

Use this section to prepare the PostgreSQL target instance.

Enable user configuration import in $NEXUS_DATA/etc/nexus.properties
```
nexus.user.configuration.source.enabled=true
```
Create blob stores on the target with names that match the source blob stores.
Delete all default repositories created during initial Nexus startup, such as maven-central, maven-releases, maven-snapshots, and nuget-hosted.
When Target instance is Nexus 3.92 and above, allow private networks for migrating proxy repositories of local instances by setting nexus.proxy.allowPrivateNetworks=true
Restart the target Nexus instance.

Important

Pre-created repositories are not overridden during migration. Leaving them in place can cause configuration inconsistencies and repository ID mismatches.

Migrator Configuration

Configure the migrator cipher password to match the source instance.

config set target-cipher-password <same-password-as-source>

What Gets Migrated

This section describes which configuration items are included in an OrientDB to PostgreSQL migration.

Configuration Or Data Type	Status	Notes
Repositories	Yes	All supported formats
Blob stores	Yes	File and S3 (S3 requires cipher)
Proprietary repositories	Yes
Repository tags	Yes	Repository tags are migrated. However, associations between components and repository tags are not migrated.
Content Selectors	Yes
Cleanup policies	Yes
Routing Rules	Yes
Privileges	Yes
Roles	Yes
LDAP role mappings	Yes	LDAP connection configured manually
Users (local)	Yes
User passwords	Yes	Requires cipher
User tokens/API keys	Yes	Requires cipher
SSL/TLS certificates	Yes	Requires cipher
Email configuration	Yes
IQ Server configuration	Yes
Logging overrides	Yes
Capabilities	Yes
Scheduled Tasks	Yes

What Does Not Get Migrated

Use this section to understand which data is intentionally excluded.

Data	Reason
Format-specific metadata files	Automatically regenerated on target
Maven metadata.xml	Regenerated
APT Packages or Release files	Regenerated
Yum repodata (`repomd.xml`, primary.xml)	Regenerated
Helm index files	Regenerated
RubyGems specifications	Regenerated
OrientDB-specific tasks	Not compatible with PostgreSQL (filtered automatically)
Audit logs	Remain on source instance, archive separately if needed
External role memberships	LDAP/SAML/Crowd users must re-authenticate after migration

Known Limitations

Use this section to understand the limits of the OrientDB to PostgreSQL migration path.

Limitation	Details
LDAP connection	Not migrated. Configure manually on target. LDAP role mappings ARE migrated.
Realms	Not migrated. Configure manually on target.
Bower repositories	Not migrated. Bower format is deprecated.
GitLFS content	Not migrated. Configuration is exported, content must be re-pushed.
H2 targets	Not supported. Use PostgreSQL.