Create a HTTPS proxy for jenkins using NGINX
In situations where you have existing web sites on your server, you may find it useful to run Jenkins (or the servlet container that Jenkins runs in) behind Nginx, so that you can bind Jenkins to the part of a bigger website that you may have. This document discusses some of the approaches for doing this.
When a request arrives for certain URLs, Nginx becomes a proxy and further forward that request to Jenkins, then it forwards the response back to the client. A typical set up for mod_proxy would look like this:
When using SSL, you might want to use something like the below nginx config.
- Terminate SSL connection at nginx
- Proxy it internally to Jenkins on port 8080
- Replace the Location Header of Jenkins with https instead of http
Note that the third point is pretty tricky. We use proxy_redirect http:// https://; that corresponds to Apaches’s ProxyPassReverse
upstream jenkins {
server 127.0.0.1:8080 fail_timeout=0;
}
server {
listen 80 default;
server_name 127.0.0.1 *.mydomain.com;
rewrite ^ https://$server_name$request_uri? permanent;
}
server {
listen 443 default ssl;
server_name 127.0.0.1 *.mydomain.com;
ssl_certificate /etc/ssl/certs/my.crt;
ssl_certificate_key /etc/ssl/private/my.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers HIGH:!ADH:!MD5;
ssl_prefer_server_ciphers on;
# auth_basic "Restricted";
# auth_basic_user_file /home/jenkins/htpasswd;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_redirect http:// https://;
add_header Pragma "no-cache";
proxy_pass http://jenkins;
}
}
Recent Comments