nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Configuration using two proxys - http and https

sandro gehrig

Hy all

I'm stuck with the proxy config since we want our JIRA accessable inside another network zone.

The setup for internal use

JIRA /Tomcat <-http-> apache proxy <-http-> client

Now we configured an nginx reverse proxy for access from an unsecure zone over ssl:

JIRA /Tomcat <-http-> apache proxy <-http-> nginx reverse proxy <-https-> client

nginx terminates ssl. I now receive the url missmatch error because of the https inside the url.

I then added this to the server.xml and restarted JIRA

scheme="https"

proxyName="<nginx ip>"

proxyPort="443"

without success, same error. The problem is there are docs for the case "apache terminates ssl then => tomcat" but none for this "two-proxy" setup.

any hints or ideas?

thanks

sandro

Accepted answers

twong_atlassian

Hi Sandro,

Is there any reason to not use the outer proxy (nginx) for all communications? If there isn't a reason, you can just use the standard doc: https://confluence.atlassian.com/display/JIRA/Integrating+JIRA+with+Apache+using+SSL

If you must have a 2 proxy setup, you could still follow the above, but set up nginx to use a the first type of connector described in the document:

<Connector acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" port="8080" protocol="HTTP/1.1" redirectPort="8443" useBodyEncodingForURI="true" scheme="https" proxyName="external.proxy.atlassian.com" proxyPort="443"/>

And use the http proxy to use the 2nd connector:

<ConnectoracceptCount="100"connectionTimeout="20000"disableUploadTimeout="true"enableLookups="false"maxHttpHeaderSize="8192"maxThreads="150"minSpareThreads="25"port="8081"protocol="HTTP/1.1"redirectPort="8443"useBodyEncodingForURI="true" proxyname = "internalproxy.com" proxyPort="80"/>

The above is untested... Normal warnings apply.

The only issue would be the base server url: I'd arbitrarily choose the external interface for most compatability.

But really.. I wouldn't set up two proxies. KISS.

Tim

All comments

C_Faysal _CFcon_

hi sandro.

i never used nginx but maybe you find some hint here

https://answers.atlassian.com/questions/16218/jira-behind-nginx-proxy-hostname-and-url-problems

setting "proxy_redirect off" may help?

twong_atlassian

Hi Sandro,

If you must have a 2 proxy setup, you could still follow the above, but set up nginx to use a the first type of connector described in the document:

And use the http proxy to use the 2nd connector:

The above is untested... Normal warnings apply.

The only issue would be the base server url: I'd arbitrarily choose the external interface for most compatability.

But really.. I wouldn't set up two proxies. KISS.

Tim

sandro gehrig

Hi Tim

First of all, thanks for the answer. There are some things I don't understand yet.

I now configured this second connector in tomcats server.xml. The nginx now connects to port 8090 (as defined in connector 1) and apache goes to 8080 (defined in connector 2). JIRA runs fine over apache and port 8080.

The reverse proxy thing however is still a bit of misery for me. So here how I think:

Unsecure_client => over https and firewall to the nginx (eth6 for example), then through the reverse proxy config. Through eth1 it calls jiras tomcat on port 8090.
Tomcats server.xml defines a proxy_port and proxy_name, here I send him to eth1 from nginx and port 8090.

Right now it redirects me to the nginx proxy ip and /secure/MyJiraHome.jspa (absolutly don't know where this comes from).

My configs are attached since there aren't any characters left for this comment (ip's and domains replaced).

(jira.example.config.txt) (tomcat.txt)

I really need help, thanks for any.

sandro gehrig

An update: co-worker had took a quick look at it, and now we went back to find the actual problem.

Right now I can access the dashboard, somehow, receiving the known error:

Dashboard Diagnostics: Mismatched URL Scheme

com.atlassian.gadgets.dashboard.internal.diagnostics.UrlSchemeMismatchException: Detected URL scheme, 'http', does not match expected scheme 'https'

The config is nothing special, only one connector for tomcat (port 8090) and nginx upstream pointing there.

&lt;Connector port="8090"

                   maxThreads="150"
                   minSpareThreads="25"
                   connectionTimeout="20000"

                   enableLookups="false"
                   maxHttpHeaderSize="8192"
                   protocol="HTTP/1.1"
                   useBodyEncodingForURI="true"
                   redirectPort="8443"
                   acceptCount="100"
                   disableUploadTimeout="true"/&gt;

and the nginx location directives (guess this is the important part, see previously attached files for complete config)

location / {
    proxy_pass http://public-jira;
   # proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  # proxy_set_header X-Forwarded-Host $host;
  # proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-Proto http;
  }

I guess I'm missing something here or have to rewrite the url in a way that JIRA can deal with it.

If anyone knows something about it, I would appreciate. I'll post the solution here as soon as I go it.

Update: I am able to log in!

The URL Scheme missmatch isn't solved yet, and so isn't the baseurl problem (jira seems to make intensiv use of it, unlike confluence)

I also added

proxy_set_header X-Forwarded-Server $host;

proxy_set_header X-Forwarded-Host $host;

to nginx config. The task now is to pretend the correct url, right now JIRA cannot display anything properly...

twong_atlassian

Hi Sandro,

I'm going off of what you told me in the last comment: 1 connector, 8090, nginx goes there.

You also said that you're terminating ssl there at the nginx.

If that is true, you should set scheme='https' in the 8090 connector.

Tim

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira