Howdy Bill!
From what I can see here, we want to forward requests made on 443 for Confluence, Git, and Jira to their respective open ports (8090, 8080, and 7990). Additionally we want to redirect from 80 to 443.
Currently JIRA and BitBucket are configured with NGINX and therefore I cannot use 8443 to redirect as JIRA is using it.
What am I not looking at properly?
I think the confusion we're seeing here is from the redirect settings in Tomcat's server.xml configuration file. This is only used when SSL is terminated at the Tomcat level and we're using security-constraints to perform redirection. In this instance it looks like you're performing the redirect and terminating SSL at the proxy level.
I took a look at your NGINX configuration and I suggest the following changes to get this working and follow best practices:
- Remove all server blocks from /etc/nginx/nginx.conf it should look something like:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
events {
worker_connections 768;
# multi_accept on;
}
http {
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
client_max_body_size 100m;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Load modular configuration files from the /etc/nginx/conf.d directory.
# See http://nginx.org/en/docs/ngx_core_module.html#include
# for more information.
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
- Create a ssl-params.conf file in /etc/nginx/snippets with the following:
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
# modern configuration. tweak to your needs.
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
add_header Strict-Transport-Security max-age=15768000;
ssl_stapling on;
ssl_stapling_verify on;
## verify chain of trust of OCSP response using Root CA and Intermediate certs
ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;
resolver <IPADDRESS> valid=300s;
- Make sure you replace <IPADDRESS> with the domain/IP used to resolve upstream servers (in your configuration it appeared to be 10.10.1.3)
- Make sure you replace /path/to/root_CA_cert_plus_intermediates with the correct path for the root CA certificate
- Create individual configuration files in /etc/nginx/sites-enabled for:
- Confluence (confluence.conf):
# Confluence configuration
server {
# Enable HTTP/2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name confluence.example.com;
# Enable SSL
ssl_certificate /path/to/example.com_ssl_certificate.cer;
ssl_certificate_key /path/to/example.com_private_key.key;
# Include the SSL configuration
include /etc/nginx/snippets/ssl-params.conf;
location /synchrony {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:8091/synchrony;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:8090/;
}
}
- Jira (jira.conf):
# Jira configuration
server {
# Enable HTTP/2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name jira.example.com;
# Enable SSL
ssl_certificate /path/to/example.com_ssl_certificate.cer;
ssl_certificate_key /path/to/example.com_private_key.key;
# Include the SSL configuration file
include /etc/nginx/snippets/ssl-params.conf;
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:8080/;
client_max_body_size 10M;
}
}
- Git (git.conf):
# Git configuration
server {
# Enable HTTP/2
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name git.example.com;
# Enable SSL
ssl_certificate /path/to/example.com_ssl_certificate.cer;
ssl_certificate_key /path/to/example.com_private_key.key;
# Include the SSL configuration file
include /etc/nginx/snippets/ssl-params.conf;
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://localhost:7990/;
client_max_body_size 10M;
}
}
- 80 to 443 redirect (ssl-redirect.conf):
server {
listen 80;
server_name git.example.com jira.example.com confluence.example.com;
return 301 https://$host$request_uri;
} - Ensure you replace the server_name, ssl_certificate, and ssl_certificate_key variables with their actual values. Note, we load the ssl-params.conf values through an include so we can have one place to make changes.
- Restart NGINX to load the changes
For the Jira and Confluence Tomcat connectors (the <connector ... /> blocks in their respective server.xml files, the redirect is essentially ignored and we only have to worry about configuring the proxyName, proxyPort, and scheme. They should look something like:
- Confluence
<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
maxThreads="48" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
protocol="org.apache.coyote.http11.Http11NioProtocol"
proxyName="confluence.example.com" proxyPort="443" scheme="https" />
- Jira
<Connector acceptCount="100" bindOnInit="false" connectionTimeout="20000" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" port="8080" protocol="HTTP/1.1" redirectPort="8443" useBodyEncodingForURI="true" proxyName="jira.example.com" proxyPort="443" scheme="https"/>
If any changes were made to the Confluence or Jira Tomcat configurations to match my recommendation above, make sure Confluence and Jira are restarted to load any changes.
This configuration should allow NGINX to properly redirect requests on port 80 to 443, and then handle those requests to serve the respective applications.
Cheers
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.