lots of fun with jenkins url

[Max Kovgan]

hi, everyone.

I've been kindly asked to setup a jenkins behind reverse proxy, via
https on port X (X!=443)
Now, this server will probably need to serve some static content, so
what the hell, let's make it run with prefix as well.

I've naively gone through:
* https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+behind+an+NGinX+reverse+proxy
* https://wiki.jenkins-ci.org/display/JENKINS/Running+Jenkins+behind+Nginx
After sorting out my understanding "childhood" problems (PEBKAC type
of things), got to a "kinda working" situation of indeed jenkins being
piped through nginx at non standard https port with prefix /jenkins.
I am starting to suspect there still are "Late Childhood" problems in
jenkins (1.642)

Problem is very frustrating: some of the links in the web app are
"working", and some are "not working"

* by "working" I mean - you click, operation is done, and you get to
the correct url, usually like this:
https://<host>:<port>/path/to/stuff
* by "non working" I mean - you get a timeout after the ajax (or non
ajax) response is trying to set your new location, but the operation
is done. The url it tries to put you at is usually:
https://<host>/path/to/stuff
yes, have you noticed the port disappeared?

let's summarize per related items:
1) After job's /configure page is accessed, sometimes (if you start
using gui to build jobs or play with them), you have to press job
"save" button. So that one "doesn't work"
BUT "apply" button working just fine.
2) Manage->"Configure Global Security" doesn't work, unless you're
typing in the URL /configureSecurity
BUT "Configure System" works just fine.
3) various plugins do not work like that.

So, is this possible with my nginx misconfigured?
Is this yet another PEBKAC on my side?

Thanks in advance!


N.B.
I have found this page:
https://wiki.jenkins-ci.org/display/JENKINS/Hyperlinks+in+HTML
It made me suspect - that if there is such a situation where there is
a need to explain plugin authors to adhere that policy... there's a
high change I'm not hallucinating.


--
Max Kovgan
+972507953455

[Daniel Beck]

On 20.12.2015, at 23:13, Max Kovgan <ma...@devopsent.biz> wrote:

> So, is this possible with my nginx misconfigured?

Are you setting X-Forwarded-Port? Find out by running `org.kohsuke.stapler.Stapler.getCurrentRequest().getHeader('X-Forwarded-Port')` in the script console.

Also interesting would be what the output of `Jenkins.instance.rootUrlFromRequest` is, as well as what is configured as the canonical URL to Jenkins in the system configuration.

[Max Kovgan]

Hi, Daniel!

Thanks, for the direction.

 whatever you've suggested, I ran:

import hudson.model.*

import jenkins.model.*

import org.kohsuke.stapler.*

println org.kohsuke.stapler.Stapler.getCurrentRequest().getHeader('X-Forwarded-Port')

println Jenkins.instance.rootUrlFromRequest

The output was:

[(master)]:
null
http://$EXT_IP/jenkins/

Yet, I expected to see:

[(master)]:
$EXT_PORT
https://$EXT_IP:$EXT_PORT/jenkins/

My nginx config did not have:
proxy_set_header   X-Forwarded-Port     $EXT_PORT;
proxy_set_header   X-Forwarded-Proto    https;

I have "played" a couple of minutes to this groovy:
import hudson.model.*
import jenkins.model.*
import org.kohsuke.stapler.*
for (def suffix in ["Port", "Proto", "For"]) {
  def header = "X-Forwarded-" + suffix
  println  "Header: " + header + "=" + org.kohsuke.stapler.Stapler.getCurrentRequest().getHeader(header)

}
println "Jenkins.instance.rootUrlFromRequest=${Jenkins.instance.rootUrlFromRequest}"

Running it renders good output.

Now, after having that set, I am getting a "nicer" erroneous behaviour:
Port is ignored, and the URLs get to:
https://$EXT_IP/jenkins/$rest_of_the_path,
and it now renders "access denied", which is cool (b/c on https port 443 we have a different application)

BUT I WANT NGINX + JENKINS to work
What am I doing wrong ?

I'm posting my current /etc/nginx/conf.d/ssl.location.d/jenkins.conf



___________________________________________

[Max Kovgan]

I managed to fix the issue: the value of header "Host" contained only IP.
After setting it to: IP:EXT_PORT, everything started working.
I'll post this to wiki later on.

Regards!

--
You received this message because you are subscribed to a topic in the Google Groups "Jenkins Users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/jenkinsci-users/9ZCj5Jrcpm0/unsubscribe.
To unsubscribe from this group and all its topics, send an email to jenkinsci-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/f669bb9e-1816-49c5-a5b2-5cd3f6b92df3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Daniel Beck]

> On 21.12.2015, at 10:19, Max Kovgan <ma...@devopsent.biz> wrote:
>
> After setting it to: IP:EXT_PORT, everything started working.

Weird, we should already support both cases (i.e. separate and combined host/port). Maybe you could take a look at this and compare to your setup?

https://github.com/jenkinsci/jenkins/blob/master/core/src/main/java/jenkins/model/Jenkins.java#L1982

[Indra Gunawan (ingunawa)]

To Max,

Would you mind sharing your nginx jenkins con file? I have followed many
URL on internet about proxy Jenkins with nginx but I am never able to make
the ³Warning Šyour proxy is broken ..² to disappear.

Thank you
-Indra

On 12/21/15, 10:39 AM, "jenkins...@googlegroups.com on behalf of
Daniel Beck" <jenkins...@googlegroups.com on behalf of

>--
>You received this message because you are subscribed to the Google Groups
>"Jenkins Users" group.
>To unsubscribe from this group and stop receiving emails from it, send an

>email to jenkinsci-use...@googlegroups.com.
>To view this discussion on the web visit

>https://groups.google.com/d/msgid/jenkinsci-users/FD6DFC5C-7082-40F0-AAE4-
>CF4FCD434E8B%40beckweb.net.