ReverseProxy - Gadgets Problem

[Fabrizio Cocco]

Hi

First, i guess i found close to all related topics in this forum to his problem, none of them could solve my problem. 

Problem:

We can't make changes in the dashboard, the google chrome console gives us a hint why not:

Failed to load resource: the server responded with a status of 500 /plugins/servlet/gadgets/dashboard-diagnostics:1 

batch.js?agile_global_admin_condition=true&baseurl-check-resources=true&healthcheck-resources=true&jag=true&jaguser=true&locale=de-DE:5635 Mixed Content: The page at 'https://jira.supsign.tech/secure/Dashboard.jspa' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://jira.supsign.tech/rest/dashboards/1.0/10100/gadget/10100/color'. This request has been blocked; the content must be served over HTTPS.

Beside note, we got this error on dashboard Page to:

We've detected a potential problem with Jira's Dashboard configuration. HideClose

Dashboard Diagnostics: Mismatched URL Scheme

Configuration:

Yes, we use a ReverseProxy before a Jira and Confluence. We tried with haproxy and nginx proxy, so the proxy isn't really the problem. We tried almost everything who is written board.

The nginx.conf for this website:

server {
listen 80;
listen [::]:80;
server_name jira.supsign.tech;
return 301 https://jira.supsign.tech;
access_log /etc/nginx/logs/confluence.supsign.tech/access.log;
error_log /etc/nginx/logs/confluence.supsign.tech/error.log warn;
}

server {
listen 443 ssl;
server_name jira.supsign.tech;
ssl_certificate /etc/letsencrypt/live/jira.supsign.tech/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/jira.supsign.tech/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

location / {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://10.100.10.60:8080; # supsvl004
include /etc/nginx/proxy.conf;
proxy_max_temp_file_size 2048m;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
client_max_body_size 100M;
}
}

The Proxy Part in server.xml

 <Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;" maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false" maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443" acceptCount="100" disableUploadTimeout="true" bindOnInit="false" secure="true" scheme="https" proxyName="jira.supsign.tech" proxyPort="443" />

The Basel-Url in the Backend

https://jira.supsign.tech

Curl from the jira instance to jira himself

curl https://jira.supsign.tech - 200

curl http://jira.supsign.tech - 301

curl http://jira.supsign.tech/rest/dashboards/1.0/10100/gadget/10100/color - 405

Last funny thing, the gadgets in the backend have all still a http:// url to the xml.

I'm very thankful for every idea and hint. 

[Fabrizio Cocco · Accepted solution]

The Problem is solved, and I will share it because there is maybe somebody else outside in the world, who is in the same way stupid I was. 

When you comment the proxy part out in server.xml, be sure to delete or comment the non proxy part! You won't get an error, if both parts are active and this was my misbehavior. 

[Andy Heinzer]

Thanks for posting back with your solution.  Don't be so hard on yourself.  The information you posted made it look like everything was ok, so I was kinda stumped as to why you would be having that problem.  Glad you figured out it was another connector in the server.xml

[Andy Heinzer]

Hi Fabrizio,

I understand that you are setting up nginx to serve as a reverse proxy for Jira and seem to be having some unexpected URL requests from Jira in the process.

Taking a closer look at your server.xml, that looks to be correct to me.  As for the nginx config, well, I am not seeing anything there that clearly seems wrong.  Which is why I would first recommend trying to restart both Nginx and Jira first to see if this might correct the problem at hand.  There are some changes that don't always take affect when setting this up until both are restarted.

If this continues after a restart, then I would suggest taking a closer look at our guide in Configure Jira server to run behind a NGINX reverse proxy. Your current configuration of nginx is pretty close to this, but there are a few suggested configuration changes that are a bit different than what you have here, for example I would suggest trying to setup your config to more closely match these steps:

• If configuring SSL, follow the instructions in https://mozilla.github.io/server-side-tls/ssl-config-generator/ to generate the profile.

• If you want to redirect HTTP to HTTPS the below can be used instead of the above block (remember to replace www.atlassian.com with the FQDN):

  server {
          listen  80 default_server;
          listen  [::]:80 default_server ipv6only=on;
          server_name atlassian.com www.atlassian.com;
          return  301 https://$server_name$request_uri;
  }

• Due to Page out of date error thrown when modifying Application Access page in Jira server , ensure that native gzip compression is turned on in JIRA. This will override Nginx's gzip compression, if configured, with no adverse effects.
• Restart Nginx.

Try these steps first.  If you're still seeing this kind of unexpected http request, please let me know what you nginx config looks like there and I will try to investigate this further.

Let me know the results.

Andy

[Fabrizio Cocco]

Wow, i didn't expect an answer to this topic anymore. Thank you very much.