How to run jira software docker with HTTPS

[ajeecai]

Hi,

I found there is an official docker for jira software here: https://hub.docker.com/r/atlassian/jira-software/ , it is good that I could have a trial with a quick docker setup. But by default it is running in http, how could I turn it into https? I don't know what options passed into the command line or how docker compose file is made up. 

Thanks for your help.

[Christian Enkrich · Accepted solution]

I succesfully changed my JIRA Software docker container to work with https today. I followed the instructions on

https://confluence.atlassian.com/adminjiraserver073/running-jira-applications-over-ssl-or-https-861253906.html#RunningJIRAapplicationsoverSSLorHTTPS-commandline

except, that I made the changes not within the file /opt/atlassian/jira/conf/server.xml, but within the file

/opt/atlassian/etc/server.xml.j2

since this is used to generate the above mentioned server.xml file during startup of the container

(see https://community.atlassian.com/t5/Jira-questions/How-to-use-a-custom-server-xml-on-Jira-Docker-image/qaq-p/1166929)

[ajeecai]

Hi, I did almost the same thing and works well now. Thank you for your sharing.

[Stefan Lindenberg]

Thank you! It took me hours to figure out, why my copied server.xml wasn't updated at all.

It would be nice, if the Confluence SSL page could also be updated to help docker users:
https://confluence.atlassian.com/doc/running-confluence-over-ssl-or-https-161203.html

[Muhammad Ramzan(Atlassian Certified Master)]

Hi @Christian Enkrich  and @Stefan Lindenberg 

Could you please guide from where we can find this path when jira is running on docker.

/opt/atlassian/etc/server.xml.j2

I mapped the home directory to volumes but i can't see this path inside the data. Normally it exist in installation directory 

[Stefan Lindenberg]

Hi, its below /opt (starting from unix-root /, not form /home), as in your path above. You can log into docker with `docker exec -it [CONTAINER_NAME] bash` and look for the file with `find / -name server.xml`.

[Muhammad Ramzan(Atlassian Certified Master)]

Thanks for your prompt response.  After reading instructions, I am putting both directory in volumes 

 volumes:    

- jira-home-data:/var/atlassian/application-data/jira    

- jira-app-data:/opt/atlassian/etc/

[Andre Untiedt]

Worked for me too, thanks! 

Had to add the following to server.xml.j2 Connector port="8443"  because Jira complained.

 relaxedPathChars="[]|"
 relaxedQueryChars="[]|{}^\`"<>"

 Then 

docker run -v jira-home:/var/atlassian/application-data/jira \
  -v jira-app:/opt/atlassian/etc \
  --name="jira" -d -p 8080:8080 -p 8443:8443 atlassian/jira-software

And poked at the web UI to get https. 

[Shankar Asam {Appfire}]

Hi,

If you can look at the overview section on the page, you will find JVM configuration page where you can pass JVM parameters into Tomcat. 

If you need to pass additional JVM arguments to Jira, such as specifying a custom trust store, you can add them via the below environment variable

• JVM_SUPPORT_RECOMMENDED_ARGS

  Additional JVM arguments for Jira

Example:

$> docker run -e JVM_SUPPORT_RECOMMENDED_ARGS=-Djavax.net.ssl.trustStore=/var/atlassian/application-data/jira/cacerts -v jiraVolume:/var/atlassian/application-data/jira --name="jira" -d -p 8080:8080 atlassian/jira-software

So you can use below in compose file by mounting the volume

JVM_SUPPORT_RECOMMENDED_ARGS   - Djavax.net.ssl.trustStore=/var/atlassian/application-data/jira/cacerts

Regards,

[ajeecai]

I did see the page you refer to but due to my less  knowledge of docker/tomcat I still don't know how to run it up.

I know that tomcat may use jks certificate then:

how I specify the password into and what the jks name should I give (/var/atlassian/application-data/jira/cacerts/server.jks?)

Should export https port instead of 8080?

Do I need to set ATL_TOMCAT_SCHEME or ATL_TOMCAT_SECURE  to 'https' ? 

Is there a brief step by step guide on how to make SSL work on docker, treating me as a stupid guy :) 

Thanks 

[Trung Quân Nguyễn]

After study the jira docker image, I think it should be better to run an nginx reverse proxy before jira + tomcat, so that SSL config will be at nginx's side.

You can follow this: https://hub.docker.com/r/atlassian/jira-software

For example:

- ATL_PROXY_NAME=jira.domain.com
- ATL_TOMCAT_SECURE=true
- ATL_PROXY_PORT=443
- ATL_TOMCAT_SCHEME=https