Create a gist now

Instantly share code, notes, and snippets.

Create a HTTP proxy for jenkins using NGINX.
sudo aptitude -y install nginx
cd /etc/nginx/sites-available
sudo rm default
sudo cat > jenkins
upstream app_server {
server fail_timeout=0;
server {
listen 80;
listen [::]:80 default ipv6only=on;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_redirect off;
if (!-f $request_filename) {
proxy_pass http://app_server;
^D # Hit CTRL + D to finish writing the file
sudo ln -s /etc/nginx/sites-available/jenkins /etc/nginx/sites-enabled/
sudo service nginx restart
mmzoo commented Mar 27, 2012

When using SSL, you might want to use something like the below nginx config.

  • Terminate SSL connection at nginx
  • Proxy it internally to Jenkins on port 8080
  • Replace the Location Header of Jenkins with https instead of http

Note that the third point is pretty tricky. We use proxy_redirect http:// https://; that corresponds to Apaches's ProxyPassReverse

upstream jenkins {
  server fail_timeout=0;

server {
  listen 80 default;
  server_name *;
  rewrite ^ https://$server_name$request_uri? permanent;

server {
  listen 443 default ssl;
  server_name *;

  ssl_certificate           /etc/ssl/certs/my.crt;
  ssl_certificate_key       /etc/ssl/private/my.key;

  ssl_session_timeout  5m;
  ssl_protocols  SSLv3 TLSv1;
  ssl_ciphers HIGH:!ADH:!MD5;
  ssl_prefer_server_ciphers on;

  # auth_basic            "Restricted";
  # auth_basic_user_file  /home/jenkins/htpasswd;

  location / {
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect http:// https://;

    add_header Pragma "no-cache";

    proxy_pass http://jenkins;
house9 commented Feb 7, 2013

I am using something similar, but one problem I have encountered - how do you also force 8080 to use ssl ? currently requests on 8080 just bypasses nginx and go straight to jenkins - i want nginx to prompt with basic auth

  • nevermind, going to update ip tables to block 8080

@house9: make jenkins listen to / localhost only.

aroxby commented Sep 2, 2014

I would humbly like to recommend using a trick like:
sudo cat > jenkins << EOF_JENKINS_EOF
Instead of Crtl-D


@rdegges How do we do it for nginx-php5-fpm


@mmzoo Thanks. add_header Pragma "no-cache" is just what I need.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment