Jenkins: How to configure Jenkins behind Nginx reverse proxy for JNLP slaves to connect

Question

I am trying to set up a Jenkins master and a Jenkins slave node where the Jenkins Master is behind Nginx reverse proxy on a different server with SSL termination. The nginx

Answer 1

The JNLP port seems to use a binary protocol, not a text-based HTTP protocol, so unfortunately it can't be reverse-proxied through NGINX like the normal Jenkins pages can be.

Instead, you should:

1. Configure Global Security > Check "Enable security" and set a Fixed "TCP port for JNLP slave agents". This will cause all Jenkins pages to emit extra HTTP headers specifying this port: X-Hudson-CLI-Port, X-Jenkins-CLI-Port, X-Jenkins-CLI2-Port.

2. Allow your fixed TCP JNLP port through any firewall(s) so CLI clients and JNLP agents can directly reach the Jenkins server on the backend.

3. Set the system property hudson.TcpSlaveAgentListener.hostName to the hostname or IP address of your Jenkins server on the backend. This will cause all pages to emit an extra HTTP header (X-Jenkins-CLI-Host) containing this specified hostname. This tells CLI clients where to connect, but supposedly not JNLP agents.

4. For each of your build slave machines in the list of nodes at jenkins.mydomain.com/computer/ that uses the Launch method "Launch slave agents via Java Web Start", click the computer, click Configure, click the Advanced... button on the right side under Launch method, and set the "Tunnel connection through" field appropriately. Read the question mark help. You probably just need the "HOST:" syntax, where HOST is the hostname or IP address of your Jenkins server on the backend.

References:

• https://issues.jenkins-ci.org/browse/JENKINS-11982
• https://support.cloudbees.com/hc/en-us/articles/218097237-How-to-troubleshoot-JNLP-slaves-connection-issues-with-Jenkins
• https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+CLI

Answer 2

It's been almost 4 years since OP has asked this question, nevertheless, if you reached this page and looking for a proper solution, well, it's now possible.

I use Traefik as reverse proxy to Jenkins. TCP port inbound completely disabled now.

The only thing you need to make sure is your agent/slave is trusting Jenkins server certificate (as webSocket cannot be used with -disableHttpsCertValidation or -noCertificateCheck

If this is a Windows agent, use:

C:\Program Files (x86)\Java\jre1.8.0_251\bin\keytool.exe -import -storepass "changeit" -keystore "C:\Program Files (x86)\Java\jre1.8.0_251\lib\security\cacerts" -alias <cert_alias> -file "<path_to_cert>"

(Change path accordingly to your java version)