# Nginx + Jenkins: it appears that your reverse proxy set up is broken

**URL:** <https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112>\
**Category:** Ask a question\
**Tags:** question\
**Created:** [December 5, 2023, 11:09am UTC](https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112 "2023-12-05T11:09:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexey](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/alexey/32/6323_2.png) [@Alexey](https://community.jenkins.io/u/Alexey)\
**Post date:** [December 5, 2023, 11:09am UTC](https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112/1 "2023-12-05T11:09:10Z")

</div>

Jenkins setup:

1. Script output:

## Jenkins: 2.426.1 OS: Linux - 5.15.0-79-generic Java: 17.0.9 - Private Build (OpenJDK 64-Bit Server VM)

ant:497.v94e7d9fffa\_b\_9  
antisamy-markup-formatter:162.v0e6ec0fcfcf6  
apache-httpcomponents-client-4-api:4.5.14-208.v438351942757  
bootstrap5-api:5.3.2-2  
bouncycastle-api:2.29  
branch-api:2.1135.v8de8e7899051  
build-timeout:1.31  
caffeine-api:3.1.8-133.v17b\_1ff2e0599  
checks-api:2.0.2  
cloudbees-folder:6.858.v898218f3609d  
command-launcher:107.v773860566e2e  
commons-lang3-api:3.13.0-62.v7d18e55f51e2  
commons-text-api:1.11.0-94.v3e1f4a\_926e49  
credentials:1309.v8835d63eb\_d8a\_  
credentials-binding:642.v737c34dea\_6c2  
display-url-api:2.200.vb\_9327d658781  
durable-task:523.va\_a\_22cf15d5e0  
echarts-api:5.4.3-1  
email-ext:2.102  
font-awesome-api:6.4.2-1  
git:5.2.1  
git-client:4.6.0  
github:1.37.3.1  
github-api:1.318-461.v7a\_c09c9fa\_d63  
github-branch-source:1752.vc201a\_0235d80  
gitlab-plugin:1.7.16  
gradle:2.9  
instance-identity:185.v303dc7c645f9  
ionicons-api:56.v1b\_1c8c49374e  
jackson2-api:2.15.3-372.v309620682326  
jakarta-activation-api:2.0.1-3  
jakarta-mail-api:2.0.1-3  
javax-activation-api:1.2.0-6  
javax-mail-api:1.6.2-9  
jaxb:2.3.9-1  
jdk-tool:73.vddf737284550  
jersey2-api:2.41-133.va\_03323b\_a\_1396  
jjwt-api:0.11.5-77.v646c772fddb\_0  
jquery3-api:3.7.1-1  
jsch:0.2.8-65.v052c39de79b\_2  
junit:1240.vf9529b\_881428  
ldap:711.vb\_d1a\_491714dc  
mailer:463.vedf8358e006b\_  
matrix-auth:3.2.1  
matrix-project:818.v7eb\_e657db\_924  
mina-sshd-api-common:2.11.0-86.v836f585d47fa\_  
mina-sshd-api-core:2.11.0-86.v836f585d47fa\_  
okhttp-api:4.11.0-157.v6852a\_a\_fa\_ec11  
pam-auth:1.10  
pipeline-build-step:516.v8ee60a\_81c5b\_9  
pipeline-github-lib:42.v0739460cda\_c4  
pipeline-graph-analysis:202.va\_d268e64deb\_3  
pipeline-groovy-lib:689.veec561a\_dee13  
pipeline-input-step:477.v339683a\_8d55e  
pipeline-milestone-step:111.v449306f708b\_7  
pipeline-model-api:2.2151.ve32c9d209a\_3f  
pipeline-model-definition:2.2151.ve32c9d209a\_3f  
pipeline-model-extensions:2.2151.ve32c9d209a\_3f  
pipeline-rest-api:2.34  
pipeline-stage-step:305.ve96d0205c1c6  
pipeline-stage-tags-metadata:2.2151.ve32c9d209a\_3f  
pipeline-stage-view:2.34  
plain-credentials:143.v1b\_df8b\_d3b\_e48  
plugin-util-api:3.6.0  
publish-over:0.22  
publish-over-ssh:1.25  
resource-disposer:0.23  
scm-api:683.vb\_16722fb\_b\_80b\_  
script-security:1294.v99333c047434  
snakeyaml-api:2.2-111.vc6598e30cc65  
ssh-credentials:308.ve4497b\_ccd8f4  
ssh-slaves:2.916.vd17b\_43357ce4  
ssh-steps:2.0.68.va\_d21a\_12a\_6476  
sshd:3.312.v1c601b\_c83b\_0e  
structs:325.vcb\_307d2a\_2782  
timestamper:1.26  
token-macro:384.vf35b\_f26814ec  
trilead-api:2.84.v72119de229b\_7  
variant:60.v7290fc0eb\_b\_cd  
workflow-aggregator:596.v8c21c963d92d  
workflow-api:1283.v99c10937efcb\_  
workflow-basic-steps:1042.ve7b\_140c4a\_e0c  
workflow-cps:3812.vc3031a\_b\_a\_c955  
workflow-durable-task-step:1289.v4d3e7b\_01546b\_  
workflow-job:1360.vc6700e3136f5  
workflow-multibranch:756.v891d88f2cd46  
workflow-scm-step:415.v434365564324  
workflow-step-api:639.v6eca\_cd8c04a\_a\_  
workflow-support:865.v43e78cc44e0d  
ws-cleanup:0.45

1. Running Jenkins directly
2. Accessed through reverse proxy
3. Installed via deb
4. Involved agents are run via SSH
5. Web browser - Chrome latest.

Jenkins server works behind the reverse proxy server, so:

user`s request → reverse proxy server nginx → jenkins server nginx → Jenkins itself

Getting this message on the Jenkins configuration page: “It appears that your reverse proxy set up is broken” .

Reverse proxy nginx configuration:

```auto
server {                                                                                              
    server_name jenkins.domain.com;

    location / {
        proxy_pass http://jenkins_server_ip:80;                                                             
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/jenkins.domain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/jenkins.domain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

```

Jenkins server nginx configuration:

```auto
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    server_name jenkins.domain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_http_version 1.1; 
        proxy_request_buffering off;
    }
}

```

After trying **administrativeMonitor/hudson.diagnosis.ReverseProxySetupMonitor/test** tool with curl a warning appears in Jenkins` log:

[http://jenkins.domain.com/manage](http://jenkins.domain.com/manage) vs. https:

It seems like for some reason it is not able to form a full URL

Additional question: is it possible to make Jenkins report why exactly it considers reverse proxy set up is broken?

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [December 5, 2023, 12:24pm UTC](https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112/2 "2023-12-05T12:24:57Z")

</div>

why 2 reverse proxy servers?

---

<div class="post-metadata">

**Author:** ![Alexey](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/alexey/32/6323_2.png) [@Alexey](https://community.jenkins.io/u/Alexey)\
**Post date:** [December 5, 2023, 12:29pm UTC](https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112/3 "2023-12-05T12:29:15Z")

</div>

Don`t know for sure, it was not made by me. As I understand, people who made it thought that it will increase security.

---

<div class="post-metadata">

**Author:** ![mawinter69](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/mawinter69/32/1625_2.png) [@mawinter69](https://community.jenkins.io/u/mawinter69)\
**Post date:** [December 5, 2023, 1:31pm UTC](https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112/4 "2023-12-05T13:31:26Z")

</div>

The opposite is true I would say. The traffic between the 2 nginx instances is unencrypted. Not sure if they run on the same host, then the traffic might not leave the host.  
But it allows to access jenkins via port 80 without ssl

---

<div class="post-metadata">

**Author:** ![Alexey](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/alexey/32/6323_2.png) [@Alexey](https://community.jenkins.io/u/Alexey)\
**Post date:** [December 5, 2023, 3:37pm UTC](https://community.jenkins.io/t/nginx-jenkins-it-appears-that-your-reverse-proxy-set-up-is-broken/11112/5 "2023-12-05T15:37:46Z")

</div>

To the ones who may face the same problem. Here is how I resolved this issue:

It turned out that Nginx variables like $scheme, $server\_port and so on are initialized using the URL of the request and not the forwarded headers. That is why Nginx on the Jenkins server was getting “http” and “80” instead of “https” and “443”.  
In order to fix it I just hardcoded these values in the configuration:

````server
    listen 80;
    server_name jenkins.domain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}```
````