Reverse proxy not working for Jira

[elmer25]

I am using a Windows Server 2016 with an Apache HTTP Server acting as the reverse proxy to the Jira server.

When I attempt to connect to the jira instance (a subdomain) on my domain, I get a 503. When I attempt to connect to http://jira.mydomain.com, the request is redirected to https://jira.mydomain.com which is expected.

The httpd.conf includes the following LoadModules plus additional default modules.

LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

 In my vhosts.conf files, I have the following defined. Please note there are 3 blocks for VirtualHost and the Jira configuration is the 2nd block.

<VirtualHost *:80>
 ServerName <subdomain1>.mydomain.com
 
 DocumentRoot C:/Apache24/htdocs
 <Directory "C:/Apache24/htdocs">
  Require all granted
 </Directory>

 RewriteEngine on

 # Redirect all traffic to https (except health check)
 RewriteCond %{HTTP:X-Forwarded-Proto} !https
 RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker
 RewriteCond %{HTTP_HOST} !^localhost
 RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# # if request is for admin, load admin.html
# RewriteRule ^admin/ admin.html [L]

 RewriteRule ^/app$ https://%{HTTP_HOST}/app/ [R=301,L]

 # everything else gets routed to index.html
 RewriteCond C:/Apache24/htdocs%{REQUEST_URI} !-f
 RewriteCond C:/Apache24/htdocs%{REQUEST_URI} !-d
 RewriteCond %{REQUEST_URI} !^/app/
 RewriteRule ^(.*)$ /index.html [L]

 # Set up proxying
 ProxyPreserveHost off
 ProxyPass /app/ http://localhost:8080/app/
 ProxyPassReverse /app/ http://localhost:8080/app/

 #Set to gzip all output
 SetOutputFilter DEFLATE
 
 #exclude the following file types
 SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|iso|tar|bz2|sit|rar|png|jpg|gif|jpeg|flv|swf|mp3)$ no-gzip dont-vary
 
 #set compression level
 DeflateCompressionLevel 9
 
 #Handle browser specific compression requirements
 BrowserMatch ^Mozilla/4 gzip-only-text/html
 BrowserMatch ^Mozilla/4.0[678] no-gzip
 BrowserMatch bMSIE !no-gzip !gzip-only-text/html
 SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
</VirtualHost>


<VirtualHost *:80>
 ServerName jira.mydomain.com

 RewriteEngine on

 # Redirect all traffic to https (except health check)
 RewriteCond %{HTTP:X-Forwarded-Proto} !https
 RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker
 RewriteCond %{HTTP_HOST} !^localhost
 RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

 # Set up proxying
 ProxyRequests Off
 
 <Proxy *>
  Require all granted
 </Proxy>
 
 ProxyPreserveHost On 
 ProxyPass / ajp://localhost:8081/
 ProxyPassReverse / ajp://localhost:8081/

 #Set to gzip all output
 SetOutputFilter DEFLATE
 
 #exclude the following file types
 SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|iso|tar|bz2|sit|rar|png|jpg|gif|jpeg|flv|swf|mp3)$ no-gzip dont-vary
 
 #set compression level
 DeflateCompressionLevel 9
 
 #Handle browser specific compression requirements
 BrowserMatch ^Mozilla/4 gzip-only-text/html
 BrowserMatch ^Mozilla/4.0[678] no-gzip
 BrowserMatch bMSIE !no-gzip !gzip-only-text/html
 SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
</VirtualHost>


<VirtualHost *:80>
 ServerName confluence.mydomain.com

 RewriteEngine on

 # Redirect all traffic to https (except health check)
 RewriteCond %{HTTP:X-Forwarded-Proto} !https
 RewriteCond %{HTTP_USER_AGENT} !^ELB-HealthChecker
 RewriteCond %{HTTP_HOST} !^localhost
 RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

 # Set up proxying
 ProxyPreserveHost off
 ProxyPass / http://localhost:8090/
 ProxyPassReverse / http://localhost:8090/

 #Set to gzip all output
 SetOutputFilter DEFLATE
 
 #exclude the following file types
 SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|iso|tar|bz2|sit|rar|png|jpg|gif|jpeg|flv|swf|mp3)$ no-gzip dont-vary
 
 #set compression level
 DeflateCompressionLevel 9
 
 #Handle browser specific compression requirements
 BrowserMatch ^Mozilla/4 gzip-only-text/html
 BrowserMatch ^Mozilla/4.0[678] no-gzip
 BrowserMatch bMSIE !no-gzip !gzip-only-text/html
 SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
</VirtualHost>

 The Jira server.xml file has two Connectors

<?xml version="1.0" encoding="utf-8"?>
<Server port="8005" shutdown="SHUTDOWN">

 ...

 <Service name="Catalina">
  <Connector port="8081" maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
   maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
   acceptCount="100" disableUploadTimeout="true" bindOnInit="false" scheme="http"
   proxyName="jira.mydomain.com" proxyPort="80"/>

 ...

  <Connector port="8009" URIEncoding="UTF-8" enableLookups="false" protocol="AJP/1.3" />

  <Engine name="Catalina" defaultHost="localhost">
   <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">

    <Context path="" docBase="${catalina.home}/atlassian-jira" reloadable="false" useHttpOnly="true">
     <Resource name="UserTransaction" auth="Container" type="javax.transaction.UserTransaction"
      factory="org.objectweb.jotm.UserTransactionFactory" jotm.timeout="60"/>
     <Manager pathname=""/>
     <JarScanner scanManifest="false"/>
    </Context>

   </Host>
   <Valve className="org.apache.catalina.valves.AccessLogValve"
    pattern="%a %{jira.request.id}r %{jira.request.username}r %t &quot;%m %U%q %H&quot; %s %b %D &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; &quot;%{jira.request.assession.id}r&quot;"/>
  </Engine>
 </Service>
</Server>

I have stopped and restarted the Apache HTTP Server and the Jira service after these changes were made.

Thank you for any insight you might have on where this may be mis-configured.

[JP _AC Bielefeld Leader_]

Hi Jim,

you redirect every request to https, but you didn't setup any vhost for port 443 (https)...

Best

JP

[elmer25]

JP, Thank you and you are correct on the redirecting to https inside the Apache conf. The redirection is to the AWS Load Balancer which is listening on port 443. From the load balancer, the target is back on port 80. There is no redirect to 443 from the load balancer. As such all requests from the Load Balancer to the target is on port 80.