To run Jenkins securely at a subdomain such as https://jenkins.example.com/, point DNS to the Nginx host, terminate TLS at Nginx, and proxy requests to Jenkins on a private HTTP listener. Configure Jenkins with the same public HTTPS URL and forward the original host and scheme so it can generate correct links and redirects.
What this setup does
A reverse proxy lets another HTTP or HTTPS server communicate with browsers on Jenkins’ behalf, as the Jenkins reverse-proxy documentation explains. In this arrangement, browsers connect to Nginx over HTTPS; Nginx forwards requests to Jenkins over HTTP on a private network connection.
As an Amazon Associate I earn from qualifying purchases.
The example below assumes Nginx and Jenkins run on the same host, with Jenkins listening on 127.0.0.1:8080. If Jenkins is remote or containerized, replace that address with the upstream address reachable from Nginx. Keep the upstream inaccessible from the public internet when it is intended to be reached only through the proxy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Prepare DNS, network access, and the certificate
- Point the chosen subdomain, such as
jenkins.example.com, to the Nginx host. - Allow inbound HTTP and HTTPS as needed for certificate issuance and for users to reach the service.
- Obtain and install a certificate covering the subdomain, together with its matching private key. Certificate issuance and renewal depend on the operating system and certificate authority; this configuration does not prescribe an issuer or automation method.
- Restrict access to the private-key file. NGINX’s HTTPS server documentation notes that the key must be readable by NGINX’s master process while remaining a securely stored file with restricted access.
Configure Nginx as the HTTPS reverse proxy
Place the following in Nginx’s http context. Replace the example hostname and certificate paths. Change the upstream if Jenkins is not listening locally at 127.0.0.1:8080.
upstream jenkins {
keepalive 32;
server 127.0.0.1:8080;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
server {
listen 80;
server_name jenkins.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name jenkins.example.com;
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/private-key.pem;
location / {
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_max_temp_file_size 0;
proxy_request_buffering off;
proxy_read_timeout 90;
}
}The HTTP server redirects requests to HTTPS. Enable that redirect after confirming the certificate is installed and the HTTPS endpoint works. The proxy_read_timeout 90 value is an example, not a universal setting; increase it if legitimate long-running requests require more time. The buffering directive follows Jenkins’ official Nginx example and can help with HTTP CLI requests that otherwise time out.
The WebSocket upgrade headers support Jenkins agents that connect over WebSocket. The mapping also preserves the empty connection value for ordinary traffic rather than forcing every request into an upgrade connection.
Nginx documents TLS 1.2 and TLS 1.3 as its current default protocol set. Add or change TLS protocol settings only if the installed Nginx/OpenSSL version or local security policy requires it.
Set Jenkins’ public URL and context path
For a subdomain served at its root, set Jenkins’ configured URL to the external HTTPS address, for example https://jenkins.example.com/. Leave the context path empty; do not add --prefix=/jenkins for this root-subdomain layout. Jenkins requires its context path to match the path at which the proxy serves it.
Rank #3
- Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
- Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
- High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
- Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
- What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
A URL such as https://example.com/jenkins/ is a path-based deployment, not a root subdomain. That arrangement requires Jenkins to use the matching prefix and is outside the configuration shown here.
Reload Nginx and verify the deployment
- Check that the Nginx configuration parses successfully using the configuration-test command provided by your Nginx installation.
- Reload Nginx using the service-management method for your operating system.
- Open
https://jenkins.example.com/and verify that the certificate is valid and the page loads over HTTPS. - Sign in and check job pages, redirects, and any agent connections you rely on. Test WebSocket agents if you use them.
- In Jenkins’ Manage Jenkins page, look for “Your reverse proxy setup is broken.” If it appears, compare the configured Jenkins URL with the browser URL and verify that Nginx forwards the expected host and HTTPS scheme.
Troubleshoot common proxy problems
Jenkins reports a broken reverse-proxy setup
Check that Jenkins’ configured URL exactly reflects the externally used HTTPS address, including any path prefix if applicable. Confirm Nginx forwards the external Host header and sets X-Forwarded-Proto to https, as in the example.
Rank #4
WebSocket agents cannot connect
Confirm the Upgrade and Connection headers are present and that Nginx uses HTTP/1.1 for the upstream connection. These headers are included in the configuration above.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHTTP CLI requests time out
The example disables request buffering and sets a 90-second read timeout. The timeout is workload-specific; adjust it for genuinely long-running commands rather than treating 90 seconds as a required value.
The proxy cannot reach Jenkins
Verify that the upstream address and port are reachable from the Nginx host. For a remote or containerized controller, use its actual Nginx-reachable network address, while keeping the upstream private if only proxied access is intended.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
