OS: Centos 7 Objective: Current jira instance: :8099 Need to go to hostname: jira.companyname.com Things I did: According to link: https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-apache-http-server-mod_proxy_http-806032611.html A. For atlassian application: 1. Stopped JIRA 2. Not using context path so ignored 3. For connector directive, In server.xml, added proxyName= "jira.companyname.com" proxyPort= "8099" scheme= "http" /> B. For Apache HTTP server 1. mod_proxy enabled by default in Centos. 2. Configure virtual host using mod_proxy, Since includeOptional statement present in httpd.conf, In conf.d folder created an jira-vm.conf file with following. ServerName jira.companyname.com ProxyRequests Off ProxyVia Off ProxyPreserveHost On Require all granted ProxyPass / http:// :8099 ProxyPassReverse / http:// :8099 3. Restart apache systemctl restart httpd.service 4. Modify CentOS SELinux policy $ sudo /usr/sbin/setsebool -P httpd_can_network_connect 1 C. Restart JIRA. Result: I dont see any response on jira.company.com On ipaddr:8099 I see my jira instance with error: " Dashboard Diagnostics: Mismatched URL Hostname JIRA is reporting that it is running on the hostname 'jira.clarionus.com', which does not match the hostname used to run these diagnostics, ' '. This is known to cause JIRA to construct URLs using the incorrect hostname, which will result in errors in the dashboard, among other issues." Server.xml snippet: Things I have tried: 1. Restarted Jira after changing XML proxyPort to 8099 instead of 80. Result: same error. Reverted back to 80. 2. Checked if conf file is case sensitive with On and Off. Result: same error. 3. Atlassian won't help as our support expired last month. :( What other areas should I look into? Thank you for your time Edit: For Solution, See my post towards the end summarizing the issues I faced.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Proxying JIRA with Apache

Priyank_rmmstc

OS: Centos 7

Objective:

Current jira instance: <Server IP addr>:8099

Need to go to hostname: jira.companyname.com

Things I did: According to link: https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-apache-http-server-mod_proxy_http-806032611.html

A. For atlassian application:

1. Stopped JIRA

2. Not using context path so ignored

3. For connector directive, In server.xml, added

proxyName=<span>"jira.companyname.com"</span>
proxyPort=<span>"8099"</span>
scheme=<span>"http"</span>/>

B. For Apache HTTP server

1. mod_proxy enabled by default in Centos.

2. Configure virtual host using mod_proxy,

Since includeOptional statement present in httpd.conf, In conf.d folder created an jira-vm.conf file with following.

<span><VirtualHost *:80></span>
    <span>ServerName</span> jira.companyname.com
     
    <span>ProxyRequests</span> <span>Off</span>
    <span>ProxyVia</span> <span>Off</span><br>    ProxyPreserveHost <span>On</span>
     
    <span><Proxy *></span>
         <span>Require</span> <span>all</span> granted
    <span></Proxy></span>
 
    <span>ProxyPass</span> / http://<ip addr>:8099
    <span>ProxyPassReverse</span> / http://<ip addr>:8099
<span></VirtualHost></span>

3. Restart apache

systemctl restart httpd.service

4. Modify CentOS SELinux policy

<span>$</span><span> sudo /usr/sbin/setsebool -P httpd_can_network_connect 1</span>

C. Restart JIRA.

Result:

I dont see any response on jira.company.com

On ipaddr:8099 I see my jira instance with error:

Dashboard Diagnostics: Mismatched URL Hostname

JIRA is reporting that it is running on the hostname 'jira.clarionus.com', which does not match the hostname used to run these diagnostics, '<ip addr>'. This is known to cause JIRA to construct URLs using the incorrect hostname, which will result in errors in the dashboard, among other issues."

Server.xml snippet:


<Connector port="8099"

maxThreads="150"
minSpareThreads="25"
connectionTimeout="20000"

enableLookups="false"
maxHttpHeaderSize="8192"
protocol="HTTP/1.1"
useBodyEncodingForURI="true"
redirectPort="8443"
acceptCount="100"
disableUploadTimeout="true"
bindOnInit="false"
proxyName="jira.company.com"
proxyPort="80"
scheme="http"/>

Things I have tried:

1. Restarted Jira after changing XML proxyPort to 8099 instead of 80. Result: same error. Reverted back to 80.

2. Checked if conf file is case sensitive with On and Off. Result: same error.

3. Atlassian won't help as our support expired last month.

What other areas should I look into?

Thank you for your time

Edit: For Solution, See my post towards the end summarizing the issues I faced.

Accepted answers

Mike Rathwell

Priyank, do you have the Apache as a proxy server imposed on you? I just went through this exercise with both Jira and Confluence (way fussier) and, after struggling for a couple of days with httpd, I threw in the towel and gave NGINX a shot.

2 hours after going down the NGINX rabbit hole, it worked. Perfectly. The configurations were a metric tonne easier to get "right". The only "gotcha" was that NGINX doesn't use cert chains quite directly. One needs to manually add in the chain to the cert file. ALSO, the way openssl creates them seems to have the cert chain in the wrong order - I had to make sure I had host -> intermediate -> root in order in the file.

Aside from that gotcha, I shall NEVER struggle with httpd again. The other bonus is that the "cookbook" examples on the Atlassian pages just... work.

All comments

Moses Thomas_08kyb0

@Priyank

For now comment ProxyReserveHost and add these two lines in proxy in <Proxy*> </Proxy> in xml proxy port should be 80 and restart jira again and see what happens?

Order deny,allow

Allow from all

Best regards,

Priyank_rmmstc

Moses,

I tried with the above recommendations. But it did not have any effect so far.

Here is my error log: Dashboard Diagnostics: Mismatched URL Hostname JIRA is reporting that it is running on the hostname 'jira.companyname.com', which does not match the hostname used to run these diagnostics, '<ip addr>'. This is known to cause JIRA to construct URLs using the incorrect hostname, which will result in errors in the dashboard, among other issues.

I am running apache 2.4 and as per this document,

Using Apache with mod_proxy

For V2.4, I think the Proxy tag should contain Require all granted.

What might be wrong? Any other ideas?

Moses Thomas_08kyb0

Firstly do you have apache server install on the host jira is running? check ip adress

and its better to have a static address in Centos7 where Jira is running, one more thing is you DNS server able to resolve the host name where Jira is running?

Vickey Palzor Lepcha

How about your ajp ? Did you enable them ?

Mike Rathwell

Aside from that gotcha, I shall NEVER struggle with httpd again. The other bonus is that the "cookbook" examples on the Atlassian pages just... work.

Priyank_rmmstc

Moses,

Yes Apache is installed as I get the version info on "httpd -v"

[root@srvvmjira bin]# httpd -v Server version: Apache/2.4.6 (CentOS) Server built: Apr 20 2018 18:10:38 [root@srvvmjira bin]#

And Static IP address is in use. Which I confirmed by "ifconfig"

Yes my DNS server can access <ipaddr>:8099 and can access JIRA. But it can't access jira.companyname.com so far.

Does that make sense? Or I might be confused.

Moses Thomas_08kyb0

@Mike Rathwell @Priyank Exactly i use nginx also and this would have been lot easier to use instead of apache i vote ngnix so may be you consider using this reverse proxy server.

Priyank_rmmstc

As per PartB in this document to enable mod_proxy_ajp:

Since Centos7 has mod_proxy_ajp_proxy modules enabled by default, I did not touch that.

In the same document as per PartB, 2. Configure the virtual hosts using mod_proxy_ajp:

Here is my code snippet at the end of my httpd.conf that I added.

<VirtualHost *:80> 
ServerName jira.companyname.com 
ProxyRequests Off 
ProxyVia Off 
# ProxyPreserveHost On 
<Proxy *> 
Require all granted 
# Order deny,allow 
# Allow from all 
</Proxy> 
ProxyPass / http://<ipaddr>:8099 
ProxyPassReverse / http://<ipaddr>:8099 

# <Location /> 
# Require all granted 
# </Location> 
</VirtualHost>

I think I followed the steps as described. I tried few things with the Location tag, proxypreservehost and order allow. But ended up commenting it out as it did not help.

Thank you for your time and patience.

Vickey Palzor Lepcha

Did you enable it on your server.xml ?

Priyank_rmmstc

Moses,

Ok I will try it out at the earliest and post my results. I appreciate your time.

Priyank_rmmstc

VIckey,

Yes I made those changes in the xml file.

<Connector port="8099"

maxThreads="150"
minSpareThreads="25"
connectionTimeout="20000"

enableLookups="false"
maxHttpHeaderSize="8192"
protocol="HTTP/1.1"
useBodyEncodingForURI="true"
redirectPort="8443"
acceptCount="100"
disableUploadTimeout="true"
bindOnInit="false"
proxyName="jira.company.com"
proxyPort="80"
scheme="http"/>

I added the last 3 lines of code for this purpose in this file.

Thank you for your time.

Priyank_rmmstc

Mike,

Ah, I see. Ok I will spend some time today and try to explore NGINX option. I shall post my updates soon.

Thank you for your time.

Priyank_rmmstc

Mike, Moses,

@Moses Thomas @Mike Rathwell

I configured NGNIX and I have discovered that there is a deeper problem to this than I first thought.

When I do an nslookup, the domain jira.companyname.com is linked to domain address 216.XX.XXX.XXX. (Accessible through outside network-Internet anywhere)

And the server IP addr that I was trying my configurations for is 10.XX.XXX.XXX (Accessible through inside company network only)

Since I was trying to link server IP addr to jira.companyname.com, it was giving me the error? This is my understanding. Correct me if I am wrong. Its still giving me the error with server IP addr and the jira.companyname.com domain.

Basically the task is "to proxy internal traffic that accesses 10.91.121.163 to Jira.companyname.com" as well as "to proxy external traffic from 216.XX.XXX.XXX to jira.companyname.com"

Not sure if I am clear enough here.

1. Will reverse proxy help me here? Or what else should I consider?

2. What Ip addr should be used in conf file? 216.XX or 10.XX because it does not work for 10.XX so far.

3. I could not find any related documentation. I am using the wrong keyword to search maybe. Can you point me in the right direction?

Your assistance helps me thoroughly.

Thank you.

Vickey Palzor Lepcha

I'd have stayed with Apache HTTP - at least I am fond of it and find it pretty easy.

Priyank_rmmstc

@Moses Thomas @Mike Rathwell @Vickey Palzor Lepcha,

I was finally able to finish this task. Here is the summary of issues faced.

1. The initial issue and the reason why I created this post was because no matter what I tried, I had a port mismatch on dashboard with Apache and NGINX.

Reason was that ports were not accessible from outside.

I totally misunderstood a text from IT that instructed me to change the DMZ port and to add a new NIC to the server. After some research I was able to make this change.

2. After I was sure the changes were ok, I was still not able to access the server. Access ports on the new server were not opened by IT when they gave me the info.

After some deliberation, we rectified that and the new NIC was up and running.

3. Going back to JIRA, I updated the server address on the nginx.conf file and JIRA was accessible from the internet. Voila!!

Or so I thought, Turns out it was still not accessible from the internal network because of some routing rules that the IT folks had in place. And also this was just HTTP not HTTPS.

4. IT came back to me with updates on their policy and they opened the ports for internal access. Jira was accessible at HTTP.

I started working on the HTTPS and sent a generated cert to IT and they forwarded it to our CA.

CA came back with a cert but the download option was not available for Nginx but only Apache. I tried to fit it in just so hoping that there was no compatibility problem.

5. But no, I got Nginx cert mismatch error. After some more research I found some post on godaddy for this case. I had to concatenate the two different certs from CA into one. After this change I thought I am all set.

6. But now when I access the site on browser, I got "URL scheme 'http', which does not match the scheme used to run these diagnostics, 'https'." on the Jira dashboard.

I changed the base URL in settings which fixed the issue. But wait.

7. In chrome, by the address bar, I got "Your connection is not fully secure" prompt for HTTPS.

When I had first switched over to Nginx, the post I had followed had recommended I add a standard HTTP connector to my server.xml file along with HTTP & HTTPS. After some troubleshooting, I understood this was the issue. I commented out that instance from my server.xml and restarted Jira.

Success!! Sweet rewarding success!!

I have learnt a lot over the course of these few days that I am truly happy. And this isn't even my primary job!

Thank you all for your support.

I deeply appreciate your assistance.

Vickey Palzor Lepcha

I had a tough time myself when AJP was introduced with JIRA for the first time. Eventually, it has been smooth.

The take away is this - you will have quite a smooth JIRA upgrades( system admin perspective) now that you know what could get reset on server.xml file during upgrade

Congratulations on your learning journey - we all are learning.

Moses Thomas_08kyb0

@PriyankGood to get feed back from you and happy that you have learned and we tried to help as much as we can.

Best!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-server