Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The reliable pattern is to terminate public HTTPS at Nginx and proxy the request to Jenkins over its local HTTP listener, normally 127.0.0.1:8080. Nginx must preserve the original host, client address, and HTTPS scheme, and it must pass WebSocket upgrades. Jenkins must use the same URL path that Nginx exposes. When those four details match, browser redirects, generated links, agents, and the HTTP CLI work correctly while Jenkins stays off the public network.
What the reverse-proxy design does
Jenkins describes a reverse proxy as an alternate HTTP or HTTPS provider that communicates with browsers on Jenkins’ behalf. In this design, Nginx owns the public certificate and listens on TCP 443. Jenkins listens on an internal address, commonly 127.0.0.1:8080, and receives requests from Nginx rather than directly from the internet.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe browser sees a URL such as https://jenkins.example.com/. Nginx decrypts that connection, adds forwarding headers, and sends an HTTP request to Jenkins. The internal hop can remain HTTP because it is local (or on a separately protected private network); the browser-facing hop is still encrypted. Restricting Jenkins’ listener to localhost or a private interface prevents users from bypassing the TLS endpoint.
Jenkins needs to know what the browser originally requested. Without that information it may believe the request was plain HTTP, generate http:// links, redirect a user to the wrong host, or report that the reverse-proxy setup is broken. The essential values are:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Host: the public hostname requested by the browser.
- X-Real-IP: the address of the immediate client as seen by Nginx.
- X-Forwarded-For: the accumulated client-address chain.
- X-Forwarded-Proto:
httpsfor a request received by Nginx on the TLS listener.
WebSocket-based agent and browser features require HTTP/1.1 and the Upgrade and Connection headers. Jenkins’ Nginx guidance also disables request buffering for HTTP CLI commands and sets explicit proxy timeouts.
Prerequisites and a safe target topology
Before editing either service, establish these facts:
- A DNS record points the Jenkins hostname to the Nginx server, for example
jenkins.example.com. - Nginx is installed and can bind to ports 80 and 443 (or the ports used by your firewall and load balancer).
- You have a certificate and matching private key for the public Jenkins hostname. The file names in the example are illustrative; use the paths provided by your certificate-issuance process.
- Jenkins is installed and its controller currently listens on
127.0.0.1:8080, or you know the actual private address and port. - Only Nginx can reach the Jenkins listener. If Jenkins must listen on another private host, restrict that port with host and network firewalls.
- You can reload Nginx and restart Jenkins during a maintenance window if a context-prefix change is required.
The official Jenkins example assumes Nginx and the controller run on the same computer. If they are separate, replace the loopback address with the private controller address and keep the connection inaccessible from untrusted networks.
Choose a root URL or a subpath before configuring anything
Decide whether Jenkins will occupy the hostname root or a path beneath another site. The choice affects every proxy rule and the Jenkins context prefix.
| Public URL | Nginx location | Jenkins setting | Operational impact |
|---|---|---|---|
https://jenkins.example.com/ |
location / |
No prefix (empty context path) | Simplest routing and generally the fewest path-related plugin issues. |
https://example.com/jenkins/ |
location /jenkins/ |
--prefix=/jenkins |
Shares a hostname with another site, but every generated URL and proxy path must retain /jenkins. |
Do not expose Jenkins at /jenkins in Nginx while leaving Jenkins at the root, or configure a root proxy while Jenkins believes it has a prefix. A mismatch commonly produces 404 responses, broken folder or Blue Ocean links, and redirects that lose the path.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Configure Jenkins’ context prefix when using a subpath
A root deployment needs no prefix change. For a subpath deployment, configure Jenkins with --prefix=/jenkins and use the same path in the Nginx location. On a Linux package installation managed by systemd, create an override:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Run
sudo systemctl edit jenkins. - Add the following unit override, changing the value only if your public path is different:
[Service] Environment="JENKINS_PREFIX=/jenkins" - Save the file, then run
sudo systemctl daemon-reload. - Restart Jenkins with
sudo systemctl restart jenkinsand confirm it is listening before changing Nginx.
Other installation methods expose the same prefix as a startup argument rather than a systemd environment variable. The requirement is the same: Jenkins’ context path and the externally visible Nginx path must be identical, including capitalization and leading slash.
Install the Nginx proxy configuration
Start with Jenkins’ current Nginx example and change only the hostname, certificate paths, and upstream address. The following configuration contains the required forwarding, WebSocket, buffering, and timeout directives for a root deployment.
upstream jenkins {
keepalive 32;
server 127.0.0.1:8080;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
server {
listen 443 ssl;
server_name jenkins.example.com;
ssl_certificate /etc/ssl/jenkins/fullchain.pem;
ssl_certificate_key /etc/ssl/jenkins/privkey.pem;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
}
}Keep proxy_pass http://jenkins; exactly without a trailing slash in this form. Adding one can make Nginx rewrite the path unexpectedly. The map sends Connection: upgrade only when the client supplied an Upgrade request; ordinary requests do not receive an unnecessary upgrade value.
Subpath variant
For a Jenkins URL of https://example.com/jenkins/, configure Jenkins with the prefix described above and use a matching location. Preserve the path rather than allowing a trailing-slash rewrite to remove it:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
location /jenkins/ {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
}
}The upstream still receives the prefixed request. Do not add a slash to proxy_pass as a shortcut for stripping /jenkins; that changes URI handling and can break Jenkins-generated paths.
Redirect HTTP requests to HTTPS
Users who type the hostname without a scheme or follow an old HTTP bookmark should reach the TLS endpoint. Add a separate port-80 server for the intended hostname:
server {
listen 80;
server_name jenkins.example.com;
return 301 https://jenkins.example.com$request_uri;
}This preserves the requested URI while changing the scheme. Keep the redirect scoped to the Jenkins hostname; a broad catch-all redirect can interfere with unrelated virtual hosts. If an upstream load balancer already performs the redirect, implement the equivalent policy there and ensure the HTTPS request that eventually reaches Nginx still carries the correct forwarding information.
Protect the certificate and the Jenkins listener
The Nginx worker must be able to read the certificate chain and private key, but unrelated users should not. Apply the ownership and mode policy appropriate for your distribution and certificate-renewal process, and test a renewal without exposing the key to the Jenkins service account.
Check that Jenkins is bound only where intended. A local installation should show a listener on 127.0.0.1:8080, not every network interface. If the service is currently public, change its bind address or apply a firewall rule before announcing the HTTPS endpoint. When Nginx needs access to Jenkins web files in a particular deployment, Jenkins documents adding the Nginx or www-data user to the Jenkins group; treat that as a least-privilege decision and verify filesystem permissions first rather than granting broad access.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Enable, test, and reload Nginx
- Save the server block in your distribution’s enabled Nginx configuration directory.
- Check syntax with
sudo nginx -t. Do not reload if this reports an error such as a missing certificate, duplicate server name, or invalid directive. - Reload the service with
sudo systemctl reload nginx. A reload applies the new configuration without needlessly stopping existing workers. - Confirm that Jenkins is healthy locally before debugging the proxy, for example by requesting its private listener from the Nginx host.
- Open the public HTTPS hostname and inspect the certificate, response code, and browser address bar.
If the certificate does not match the hostname, fix the certificate or the selected server_name before investigating Jenkins. A successful TLS handshake only proves that Nginx presented a certificate; it does not prove that the upstream routing or Jenkins URL settings are correct.
Validate all traffic classes, not just the login page
A proxy can display the login form while still failing agents or the CLI. Use this checklist after every configuration change:
- HTTPS persistence: sign in, follow several administration and job links, and confirm the browser remains on the HTTPS hostname.
- Generated URLs: inspect redirects and links for the correct host, scheme, and (when applicable)
/jenkinsprefix. - WebSockets: exercise a WebSocket-dependent agent or feature. Failures usually indicate a missing HTTP/1.1, Upgrade, or Connection setting.
- HTTP CLI: run a representative command, including one that streams output. Request buffering must remain disabled for reliable CLI behavior.
- Long operations: observe a command or request that legitimately runs for several minutes. Increase
proxy_read_timeoutif Nginx closes an otherwise healthy long-running operation. - Reverse-proxy monitor: inspect Jenkins’ reverse-proxy monitoring and resolve any warning it reports instead of dismissing it.
Test both a fresh browser session and an existing session. Cached redirects can hide an incorrect scheme, while an old cookie path can hide a context-prefix mistake.
Troubleshoot the common failure messages
Jenkins says “Your reverse proxy setup is broken”
Jenkins actively checks whether requests and responses are being rewritten consistently. Verify the Host and X-Forwarded-Proto values first, then check whether your environment also requires X-Forwarded-Host or X-Forwarded-Port. The public HTTPS request must arrive at Jenkins as an HTTPS-origin request even though Nginx uses HTTP on the upstream connection. Review the reverse-proxy monitor after each correction.
Redirects point to HTTP or links show the wrong scheme
On the TLS server block, $scheme evaluates to https. Ensure the request reaches that block and that this value is sent as X-Forwarded-Proto. If another load balancer sits in front of Nginx, make sure it does not overwrite the value with http. Also confirm that the configured Jenkins URL uses the public HTTPS address rather than the private listener.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
WebSocket agents fail while ordinary pages work
Check all three pieces together: proxy_http_version 1.1, proxy_set_header Upgrade $http_upgrade, and the Connection value generated by the map. A proxy that forwards only normal HTTP requests can still serve the dashboard and jobs but will reject the WebSocket handshake.
CLI commands hang, stream poorly, or end with premature EOF
Keep proxy_request_buffering off in the Jenkins location. For operations that legitimately exceed the configured period, raise proxy_read_timeout above the command’s expected duration and reload Nginx. Do not solve a backend failure by setting an unlimited timeout; first confirm that Jenkins itself continues processing the request.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →404 responses, missing folders, or broken Blue Ocean URLs
Compare the public path, the Nginx location, and Jenkins’ prefix character for character. A root deployment should not acquire an accidental /jenkins prefix; a subpath deployment must retain it. Inspect proxy_pass for an unintended trailing slash, which changes URI replacement rules.
The browser reaches Nginx, but Nginx cannot reach Jenkins
Confirm that Jenkins is running, that the upstream address and port are correct, and that local firewall rules permit the Nginx worker to connect. If the services are on different hosts, test the private address from the Nginx host and restrict that route to the required source. A TLS certificate problem and an upstream connectivity problem occur at different layers, so use Nginx’s error log and a direct private-listener test to distinguish them.
Nginx cannot read Jenkins web files
Some deployments allow Nginx to serve or inspect files under the Jenkins web root. Follow Jenkins’ documented permission model, verify the Nginx account and directory traversal permissions, and grant only the narrow group access required. Avoid making the web root world-readable or adding Nginx to a powerful administrative group without checking the consequences.
Root host versus subpath: which is safer operationally?
A dedicated hostname with Jenkins at / is usually the simpler choice: the certificate covers one Jenkins name, redirects do not need path manipulation, and plugins see the paths they normally generate. A subpath is appropriate when an existing hostname must be shared, but it adds a second value that must remain synchronized across Jenkins, Nginx, bookmarks, integrations, and upgrade checks.
Recommended Free Tools
Quick Recap
| Decision factor | Root deployment | Subpath deployment |
|---|---|---|
| Context-path complexity | Minimal; Jenkins uses its default root. | Higher; Jenkins and Nginx must both use the same prefix. |
| Certificate scope | Certificate covers a dedicated Jenkins hostname. | Certificate covers the shared parent hostname. |
| Redirect behavior | Scheme-only redirect is straightforward. | Redirect must preserve the application path exactly. |
| Plugin compatibility | Fewer path assumptions to investigate. | Test folder, Blue Ocean, webhook, and plugin-generated URLs carefully. |
| Operational simplicity | Usually easiest to document and troubleshoot. | Useful for shared domains, but requires stricter path discipline. |
Ongoing checks after the first deployment
- Keep the certificate renewal process able to update the files Nginx reads, then reload Nginx after a successful renewal.
- Re-run
nginx -tbefore every reload, including changes made by automation. - Recheck the Jenkins reverse-proxy monitor after Nginx, Jenkins, load-balancer, or DNS changes.
- Retest a WebSocket feature and a streaming CLI command after upgrades; these paths expose proxy regressions that a simple page load will not.
- Monitor logs for requests arriving on the private Jenkins port from unexpected sources. The intended access path is the TLS endpoint through Nginx.
- Document the public URL, context prefix, upstream address, certificate paths, and the exact systemd override so another administrator can restore the service safely.
Final deployment checklist
- DNS resolves the public Jenkins hostname to the Nginx endpoint.
- The certificate and private key match that hostname and are readable only by the required service accounts.
- Jenkins listens on its private address, and direct untrusted access is blocked.
- The Nginx upstream points to the correct Jenkins address and port.
Host,X-Real-IP,X-Forwarded-For, andX-Forwarded-Protoare forwarded.- WebSocket Upgrade and Connection headers, HTTP/1.1, disabled request buffering, and the documented timeouts are present.
- There is an HTTP-to-HTTPS redirect for the intended hostname.
- The Nginx path and Jenkins context prefix are identical, or both are root deployments.
nginx -tsucceeds before reload.- Browser navigation, redirects, a WebSocket-dependent feature, a streaming CLI command, and Jenkins’ reverse-proxy monitor all pass.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
