iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To run Jenkins securely on a subdomain, point the subdomain to the Nginx host, terminate HTTPS at Nginx, and proxy requests to Jenkins over a private HTTP connection. Configure Jenkins with the same public HTTPS URL and preserve the original host and scheme in forwarded headers. The example below assumes Nginx and Jenkins run on the same host; for a remote or containerized controller, use an upstream address reachable from Nginx.
Before configuring Nginx
- Create a DNS record for your chosen subdomain, such as
jenkins.example.com, pointing to the Nginx host. - Allow inbound HTTP and HTTPS as required for certificate issuance and public service.
- Obtain a certificate covering the subdomain. Certificate issuance and renewal depend on your operating system and certificate authority; this proxy configuration does not prescribe an issuer or automation method.
- Confirm the Jenkins upstream is reachable from Nginx. If Jenkins is intended to be accessible only through the proxy, do not expose its upstream port publicly.
The certificate’s private key must be protected. NGINX notes that it should have restricted file access while remaining readable by the Nginx master process: Configuring HTTPS servers.
Configure Nginx as the HTTPS reverse proxy
Add the following configuration in Nginx’s http context. Replace the example hostname, certificate paths, and upstream address with values appropriate for your installation. The upstream shown is Jenkins on the same host at 127.0.0.1:8080.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11upstream jenkins {
keepalive 32;
server 127.0.0.1:8080;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
server {
listen 80;
server_name jenkins.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name jenkins.example.com;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/private-key.pem;
location / {
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_max_temp_file_size 0;
proxy_request_buffering off;
proxy_read_timeout 90;
}
}The HTTP server block redirects requests to HTTPS. Enable that redirect only after the certificate is installed and HTTPS is working. Nginx’s current default TLS protocol set is TLS 1.2 and TLS 1.3; add protocol settings only if your installed Nginx/OpenSSL version or local security policy requires them. Jenkins’ official Nginx reverse-proxy example includes additional static-file optimizations and user-content handling that are not required for this basic subdomain proxy.
#1 Best Overall
Adapt the upstream for remote or containerized Jenkins
If Jenkins is not listening on the same host, replace 127.0.0.1:8080 with the address and port that Nginx can reach in your network or container setup. Keep the upstream private when access through Nginx alone is intended.
Keep proxy settings appropriate to the workload
The example disables request buffering and sets proxy_read_timeout 90. The timeout is an example, not a universal setting; increase it if a legitimate long-running request needs more time. Treat buffering and body-size limits as operational choices for your workload rather than applying arbitrary limits.
Rank #2
Set Jenkins’ public URL and context path
In Jenkins, set the configured Jenkins URL to the external HTTPS address, for example https://jenkins.example.com/. Because this subdomain serves Jenkins at the root of its host, leave the context path empty; do not start Jenkins with --prefix=/jenkins. Jenkins requires its context path to match the path where the proxy serves it. A URL such as https://example.com/jenkins/ is a separate, path-based deployment and requires Jenkins to use that prefix.
The forwarded Host and X-Forwarded-Proto headers in the example tell Jenkins the public hostname and HTTPS scheme, helping it produce correct URLs and redirects. The Jenkins documentation describes a reverse proxy as an alternate HTTP or HTTPS provider communicating with browsers on Jenkins’ behalf: Reverse proxy configuration.
Reload and verify the proxy
- Validate the Nginx configuration using the configuration-test command appropriate to your installation, then reload Nginx.
- Open
https://jenkins.example.com/and verify that the page loads over HTTPS. - Test sign-in, job pages, and redirects. Check that generated links continue to use the HTTPS subdomain.
- Check agent connectivity. WebSocket agents require the
UpgradeandConnectionheaders shown in the configuration. - In Jenkins, look on the Manage Jenkins page for the warning “Your reverse proxy setup is broken.”
Troubleshoot common failures
Jenkins reports that the reverse proxy setup is broken
Compare the configured Jenkins URL with the URL in your browser. Confirm that Nginx forwards the external host and HTTPS scheme, and review proxy response handling against Jenkins’ reverse-proxy troubleshooting guidance.
WebSocket agents cannot connect
Check that the Upgrade and mapped Connection headers are present in the HTTPS location. The mapping preserves upgrade behavior while allowing ordinary keepalive traffic to use the appropriate connection handling.
HTTP CLI requests time out
The example turns off request buffering. If a command genuinely runs longer than the configured read timeout, raise proxy_read_timeout to suit that workload; the example’s 90-second value is not a universal recommendation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The proxy cannot reach Jenkins
Verify that the upstream hostname and port are reachable from the Nginx host or container. A loopback address such as 127.0.0.1 works only when Jenkins listens on that same network namespace; a containerized deployment may require a different reachable address. Keep public access to the upstream closed when Nginx is meant to be the entry point.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
