title: Jenkins with reverse proxy to alternative port number
body: <p>I have a jenkins builder server and I'm trying to set up the reverse proxy with nginx. I followed all the howto's and documentation from the jenkins site but the only thing different is I need the server to be reachable on a different port then the standerd https port.</p>
  
  <p>The server has to be reachable at <code>https://jenkins.example.com:9090</code> which is working now but I'm still having some issues with it. In Manage Jenkins I keep getting the message </p>
  
  <blockquote>
    <p>It appears that your reverse proxy set up is broken</p>
  </blockquote>
  
  <p>also when I login or apply or save some configuration change I keep getting redirected to <code>https://jenkins.example.com</code> with out the port number.</p>
  
  <p>When I check with curl and look in the headers for a some pages it keeps setting the location header to the correct url but without the port number.</p>
  
  <p>I have the following configuration in nginx</p>
  
  <pre><code>server {
    listen 443 ssl spdy;
    server_name jenkins.example.com;
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
    add_header X-Frame-Options "DENY";
  
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.chain.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-$
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  
    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
  
    # enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
    # http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
    resolver 8.8.8.8;
    ssl_stapling on;
    ssl_trusted_certificate /etc/nginx/ssl/server.crt;
  
    access_log            /var/log/nginx/jenkins.access.log;
  
    location / {
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;
  
      # Fix the "It appears that your reverse proxy set up is broken" error.
      proxy_pass          http://127.0.0.1:8080/;
      proxy_read_timeout  90;
  
      proxy_redirect      http://127.0.0.1:8080 https://jenkins.example.com:9090;
    }
  }
  </code></pre>
  
  <p>In the default config for jenkins I added <code>--httpListenAddress=127.0.0.1</code> and in the Manage Jenkins --> Configure System I have added the correct url with port number <code>https://jenkins.example.com:9090/</code> to Jenkins Location.</p>
  
  <p>These are the headers when I use curl to check them.</p>
  
  <pre><code>curl -I  https://jenkins.example.com:9090/scriptApproval
  HTTP/1.1 302 Found
  Server: nginx/1.9.4
  Date: Thu, 24 Sep 2015 13:17:56 GMT
  Content-Length: 0
  Connection: keep-alive
  X-Content-Type-Options: nosniff
  Location: https://jenkin.example.com/scriptApproval/
  Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
  X-Frame-Options: DENY
  </code></pre>
  
  <p><strong>Update 1</strong></p>
  
  <p>When adding <code>proxy_set_header X-Forwarded-Port 9090;</code> to the nginx config this seems to fix the error <code>It appears that your reverse proxy set up is broken</code> on the settings page.</p>
  
  <p><strong>Update 2</strong></p>
  
  <p>Maybe it has something to do with having a trailing slash. When I call <code>https://build.example.com:9090/pluginManager/</code> with curl I get a 403 Forbidden repsonse from jenkins But when a call <code>https://build.example.com:9090/pluginManager</code> without the trailing slash I get a 302 Found response with the location header set to <code>https://build.example.com/pluginManager/</code></p>
  
  <p><strong>Update 3</strong></p>
  
  <p>This server is connected on a shared internet connect with more server running on which are beyond my control. Its only running Jenkins CI and nginx which should be the reverse proxy. The WAN port on the router is listing to port 9090 which forwards to the server on port 443 which should be Nginx which should proxy everything to Jenkins-CI which is listening to port 8080.</p>
  
  <p><strong>Update 4</strong></p>
  
  <p>This is current config I have tried. Which also doesn't seem to work.</p>
  
  <pre><code>upstream jenkins {
    server 127.0.0.1:8080 fail_timeout=0;
  }
  
  server {
    listen 9090 default ssl http2;
    server_name build.pixplicity.com;
  
    ssl on;
    ssl_certificate /etc/nginx/ssl/server.chain.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
  
    access_log            /var/log/nginx/jenkins.access.log;
  
    location / {
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto https;
      proxy_set_header        X-Forward-Port 9090;
  
      # Fix the "It appears that your reverse proxy set up is broken" error.
      proxy_pass          http://127.0.0.1:8080;
      proxy_read_timeout  90;
  
      proxy_redirect http://127.0.0.1:8080 https://build.pixplicity.com:9090;
      #proxy_redirect default;
    }
  }
  </code></pre>