Nginx – Trying to run Jenkins behind SSL reverse proxy – 404 http://localhost/jenkins/manage vs. https:

Jenkinsnginxreverse-proxyssl

I am trying to run Jenkins behind nginx. Jenkins runs in a Docker container, listening on Port 8080 from directory /jenkins. My nginx container has this Jenkins container linked as hostname "jenkins", so in its context, Jenkins is accessible via http://jenkins:8080/jenkins.

I followed the steps at Running Jenkins from a folder with TLS encryption and thus my site-config contains this:

location ^~ /jenkins/ {
    sendfile off;
    proxy_set_header   Host             $host;
    proxy_set_header   X-Real-IP        $remote_addr;
    proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_pass http://jenkins:8080/jenkins/;
    proxy_redirect http:// https://;
    proxy_max_temp_file_size 0;
    client_max_body_size       64m;
    client_body_buffer_size    128k;
    proxy_connect_timeout      90;
    proxy_send_timeout         90;
    proxy_read_timeout         90;
    proxy_buffer_size          4k;
    proxy_buffers              4 32k;
    proxy_busy_buffers_size    64k;
    proxy_temp_file_write_size 64k;
  }

I am now trying to access the nginx from localhost, and calling https://localhost/jenkins presents me Jenkins. However, when I go to "Manage Jenkins", I get the message that my reverse proxy setup is incorrect. I tried

curl -k -iL -e https://localhost/jenkins/manage \
   https://localhost/jenkins/administrativeMonitor/hudson.diagnosis.ReverseProxySetupMonitor/test

which gives me a 404 with http://localhost/jenkins/manage vs. https:.

When I add

    proxy_set_header   X-Forwarded-Proto  https;
    proxy_set_header   X-Forwarded-Port 443;
    proxy_set_header   X-Forwarded-Ssl on;

the message changes to https://localhost/jenkins/manage vs. https:

What am I missing?

Best Answer

I had a problem like this just now, and what solved it for me was described in https://stackoverflow.com/a/20514632/1446479

My NOT working config used this line:

proxy_pass http://127.0.0.1:8015/jenkins/;

But my working config now looks like this:

location /jenkins/
{
  proxy_pass http://127.0.0.1:8015$request_uri;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-for $remote_addr;
  port_in_redirect off;
  proxy_redirect http://my.host/jenkins /jenkins;
  proxy_connect_timeout 300;
}

Related Solutions

Nginx proxy pass works for https but not http

I believe you need a separate server block for HTTP. For example:

server {
listen 80;

location / {
        proxy_redirect off;
        proxy_cache off;
        proxy_pass         http://127.0.0.1:5000;
        proxy_set_header   Host             $http_host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
}
}

You would then remove listen 80; from the existing server block.

Nginx/Apache: set HSTS only if X-Forwarded-Proto is https

You could have multiple server blocks. So just add new server block for domains that need HSTS.

server {
    listen xx.xx.xxx.xxx:443 ssl default_server;

    # all ssl stuff
    # and other directives
}

server {
    listen xx.xx.xxx.xxx:443 ssl;
    server_name example.com other.example.com;

    # all ssl stuff
    # and other directives with HSTS enabled
}

Here first block will handle all https connections except example.com and other.example.com.

And you don't need ssl on directive if you have ssl flag in listen.

EDIT

There is another solution with only one server block:

map $scheme:$host $hsts_header {
    default "";
    https:example.com "max-age=31536000";
    https:other.example.com "max-age=31536000";
}

server {
    server_tokens off;

    listen xx.xx.xxx.xxx:80;
    listen xx.xx.xxx.xxx:443 ssl;

    ssl_certificate /etc/ssl/foo.crt;
    ssl_certificate_key /etc/ssl/private/foo.key;

    ssl_session_timeout 10m;

    # ... other ssl stuff

    location / {
        proxy_pass http://127.0.0.1:81;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Host $host;
        add_header X-XSS-Protection "1; mode=block";
        add_header Strict-Transport-Security $hsts_header;
    }
}

We use map to define HSTS header value and use the fact, than nginx will not add header with empty value.

Best Answer

Related Solutions

Nginx proxy pass works for https but not http

Nginx/Apache: set HSTS only if X-Forwarded-Proto is https

Related Topic