Nginx Configuration for Confluence Docker Image

Anil G_wd1hgi

Hi Team,

 

We have deployed the docker confluence server in the host and we are able to access the application on http://ip:port

Now we want to enable TLS encryption using Nginx.

May we know the Nginx Config to implement same.

 

 

--

Thanks,

Anil Kumar

Lei Wang

Hello Anil,

Here is how I set up Nginx in front of Confluence docker container:

1. Pull the official Nginx docker container
   

   docker pull nginx

2. You will need a docker network for confluence and nginx
   

   docker network create confserver

3. Create the Confluence container with proxy tages
   

   docker run \
   --name="confluence" -d \
   -p 8090:8090 \
   -p 8091:8091 \
   -v ~/confluence-home/confluence-docker:/var/atlassian/application-data/confluence \
   -e CATALINA_CONNECTOR_PROXYNAME=test.myapp.com \
   -e CATALINA_CONNECTOR_PROXYPORT=443 \
   -e CATALINA_CONNECTOR_SCHEME=https \
   -e CATALINA_CONNECTOR_SECURE=false \
   --network confserver \
   atlassian/confluence-server

4. Create the Nginx container in the same confserver network as Confluence
   

   docker run \
   --name="nginx" -d \
   -p 443:443 \
   --network confserver \
   -v ~/dockerdata/nginx/conf:/etc/nginx/conf.d/ \
   -v ~/dockerdata/nginx/ssl:/mnt \
   nginx

5. Stop Nginx container, create the SSL certificate/key pair and default.conf then copy them to the host volume accordingly
   

   docker stop nginx
   cp confluence.key ~/dockerdata/nginx/ssl
   cp confluence.crt ~/dockerdata/nginx/ssl
   cp default.conf ~/dockerdata/nginx/conf

Now start Nginx and you should be able to access the Confluence container via port 443 https://test.myapp.com.

Lastly, here is my Nginx https configuration in default.conf:

    listen          443;
&nbsp;&nbsp;&nbsp;&nbsp;server_name&nbsp;&nbsp;&nbsp;&nbsp;<span>&nbsp;</span>test.myapp.com;
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;ssl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; on;
&nbsp;&nbsp;&nbsp;&nbsp;ssl_certificate&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span>&nbsp;</span>/mnt/confluence.crt;
&nbsp;&nbsp;&nbsp;&nbsp;ssl_certificate_key&nbsp;&nbsp;&nbsp;&nbsp;<span>&nbsp;</span>/mnt/confluence.key;
&nbsp;&nbsp;&nbsp;&nbsp;ssl_session_timeout&nbsp;&nbsp;&nbsp;&nbsp; 5m;
&nbsp;&nbsp;&nbsp;&nbsp;ssl_protocols&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; TLSv1 TLSv1.1 TLSv1.2;
&nbsp;&nbsp;&nbsp;&nbsp;ssl_ciphers&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; HIGH:!aNULL:!MD5;
&nbsp;&nbsp;&nbsp;&nbsp;ssl_prefer_server_ciphers&nbsp;&nbsp; on;
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;location / {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;client_max_body_size 100m;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# We need FQDN name here <docker_container_name>.<docker_network_name>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_pass&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; http://confluence.confserver:8090/;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp; X-Forwarded-Host $host;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp; X-Forwarded-Server $host;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header&nbsp;&nbsp;&nbsp; X-Forwarded-For $proxy_add_x_forwarded_for;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#proxy_set_header&nbsp;&nbsp;&nbsp; X-Real-IP $remote_addr;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#proxy_redirect&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; off;
&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;location<span>&nbsp;</span>/synchrony {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header X-Forwarded-Host $host;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header X-Forwarded-Server $host;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_pass http://confluence.confserver:8091/synchrony;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_http_version 1.1;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header Upgrade $http_upgrade;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;proxy_set_header Connection<span>&nbsp;</span>"Upgrade";
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}
&nbsp;}server {

Hope this information helps!

Best Regards.