Recommended Free Tools
Put Nginx in front of Concourse as the public HTTPS endpoint, terminate TLS on port 443, and proxy requests to the Concourse web node. Set CONCOURSE_EXTERNAL_URL to the exact public HTTPS address, preserve the forwarded host and scheme headers, and configure a separate /hijack location with WebSocket upgrade headers. That combination fixes browser redirects, authentication callbacks, and fly intercept sessions without exposing the Concourse web service directly.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The example below assumes Nginx terminates TLS and Concourse listens on an internal HTTP address such as concourse.local:8080. It also explains the certificate choices, multi-node layouts, validation sequence, and failure symptoms you should check before putting the endpoint into service.
As an Amazon Associate I earn from qualifying purchases.
What the secure topology looks like
A Concourse installation normally has three logical parts: web nodes serve the UI and API and perform scheduling; worker nodes execute jobs; and PostgreSQL stores Concourse state. Nginx belongs in front of the web tier, not between workers and the database. Clients resolve a public DNS name to Nginx, Nginx presents the certificate, and only then does it forward the request to Concourse.
| Component | Role in this setup | Publicly reachable? |
|---|---|---|
| Nginx | Public TLS listener on port 443 and reverse proxy | Yes, at the chosen DNS name |
| Concourse web node | UI, API, authentication redirects, scheduling, and hijack endpoint | No; keep it on an internal address when possible |
| Concourse workers | Run pipeline tasks | No |
| PostgreSQL | Stores Concourse data | No |
Use a name such as ci.example.com that resolves to the Nginx host. The certificate must contain that hostname. The URL users open, the hostname in the certificate, and the value Concourse uses for external links must describe the same endpoint.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prerequisites and decisions
Before editing Nginx, confirm the following items:
- A DNS record for the public Concourse name points to the Nginx address.
- A certificate covers that exact name, with the leaf certificate followed by any required intermediate certificates in the PEM bundle.
- The Nginx master process can read the private-key file, while untrusted users and processes cannot.
- Nginx can reach the Concourse web node on its internal address and port.
- You know whether TLS ends at Nginx or must be encrypted again between Nginx and Concourse.
- You can change the Concourse web environment and reload Nginx during a maintenance window.
The common arrangement is TLS termination at Nginx and plain HTTP on the protected internal network. If policy requires encryption on that internal hop, use the upstream-HTTPS variation described later instead of copying the HTTP proxy_pass unchanged.
Set Concourse’s public URL first
Set the web node’s external URL to the address users actually open:
CONCOURSE_EXTERNAL_URL=https://ci.example.comConcourse uses this value when it builds links and authentication redirects. It must use the public HTTPS scheme and hostname, not the internal address, an IP address, or an HTTP URL. A mismatch commonly produces redirects to the wrong host, redirects that fall back to HTTP, or login callbacks that no longer match the browser’s origin.
What to check in the value
- Scheme: use
httpsbecause Nginx is the public TLS endpoint. - Hostname: use the DNS name covered by the certificate and entered by operators in
fly. - Port: omit a nonstandard port only when users really connect through the standard HTTPS listener; otherwise represent the externally reachable port accurately.
- Consistency: use one canonical public name rather than switching between aliases during login or CLI use.
After changing the environment, restart or otherwise reload the Concourse web service according to your deployment method. Nginx cannot correct a web node that still believes its external address is HTTP.
Prepare the certificate and key
Nginx needs both the certificate chain and the private key in the server block. A typical managed certificate layout is:
ssl_certificate /etc/letsencrypt/live/ci.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ci.example.com/privkey.pem;The certificate file should contain the leaf certificate first and the intermediate certificates after it. Supplying only the leaf can make some clients report an incomplete chain even though the hostname is correct. Protect the key with filesystem permissions that permit the Nginx master process to read it but deny access to ordinary users.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Choose a renewal owner
When Nginx is the public TLS endpoint, let the host’s certificate-management system obtain and renew the certificate, then reload Nginx after a successful renewal. A renewed file is not enough by itself: the running Nginx workers must be reloaded before they begin serving the new certificate.
Concourse can obtain a Let’s Encrypt certificate itself by setting CONCOURSE_ENABLE_LETS_ENCRYPT=true and exposing the web node to the ACME service. In that mode Concourse stores the certificate and key in its database, so the Concourse documentation treats database encryption as imperative. This approach is usually unnecessary when Nginx already owns the public TLS listener; select one certificate owner and document it so the two systems do not compete for issuance or renewal.
Configure Nginx for HTTPS and normal requests
Use a TLS-enabled server block similar to the following. Replace the certificate paths and upstream name with values from your environment.
server {
listen 443 ssl;
server_name ci.example.com;
ssl_certificate /etc/letsencrypt/live/ci.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ci.example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security "max-age=31536000" always;
location / {
proxy_pass http://concourse.local:8080/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
}
location ~ /hijack$ {
proxy_pass http://concourse.local:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}What the TLS directives do
listen 443 ssl enables HTTPS on the standard TLS port for this server block. server_name selects the block for the public DNS name. The certificate and key directives identify the files Nginx presents during the handshake. The example restricts protocol negotiation to TLS 1.2 and TLS 1.3, matching the current official pattern; keep those versions aligned with the Nginx and OpenSSL support available on your host.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The HSTS header tells a browser to use HTTPS for the named site for 31,536,000 seconds. Because the header is marked always, Nginx adds it on error responses as well as successful responses. Enable HSTS only after the HTTPS endpoint is stable: a browser that has accepted the policy will refuse ordinary HTTP access until the max-age period expires.
Why each forwarded header matters
The normal location forwards the request to the web node while retaining the information that was visible at the edge:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Hostcarries the public host name used by the client.X-Real-IPidentifies the immediate client address.X-Forwarded-Forpreserves the proxy chain rather than replacing it with Nginx’s address.X-Forwarded-ProtoandX-Forwarded-Protocoltell Concourse that the original request used HTTPS.X-Forwarded-Hostpreserves the host header as received by Nginx.
Without the scheme and host information, Concourse may generate links for its internal HTTP address or send a browser back to the wrong protocol. Keep the complete set in both locations so ordinary requests and upgraded connections see the same origin.
Make fly intercept work through the proxy
The dashboard can appear healthy while fly intercept fails because an intercept uses an upgraded, WebSocket-style connection. Concourse’s documentation specifically requires a reverse proxy or load balancer to upgrade that connection correctly.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The dedicated regular-expression location matches request paths ending in /hijack. It repeats the forwarded identity headers and adds:
Upgrade $http_upgrade, which passes the client’s upgrade request.Connection "upgrade", which tells the upstream connection to switch protocols.
Do not test only the home page. A proxy can successfully serve static UI files and API responses while silently dropping the upgraded stream. After the browser login works, run a representative fly intercept session, keep it open long enough to exchange data, and exit normally. A session that immediately disconnects, hangs while connecting, or never displays the task shell usually points to this location or to an upstream reachability problem.
Understand the proxy path and trailing slashes
The normal location uses proxy_pass http://concourse.local:8080/; with a trailing slash. The /hijack location uses proxy_pass http://concourse.local:8080; without one, matching the official pattern. Keep the two forms as shown unless you have deliberately tested a different URI-rewrite behavior; changing a trailing slash can alter the path delivered to Concourse.
The regular-expression location is intentionally separate from location /. It ensures that the upgrade headers apply only to the hijack endpoint instead of changing every proxied request. If your deployment places another proxy or load balancer in front of Nginx, that device must preserve the same upgrade semantics all the way to the web node.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
If the Concourse upstream also uses HTTPS
The example assumes Nginx terminates TLS and connects to an internal HTTP listener. If the web node itself requires HTTPS, change the upstream URL to an HTTPS address and configure the Nginx proxy TLS directives and certificate-verification settings documented for the proxy module. Verify the upstream certificate rather than disabling verification as a shortcut. The public certificate and the internal upstream certificate are separate concerns: clients validate the former, while Nginx validates the latter.
Keep the forwarded scheme headers representative of what the client used. A browser connecting to Nginx over HTTPS should still be described to Concourse as HTTPS, even when Nginx re-encrypts or decrypts the second hop.
Compare deployment and certificate choices
| Arrangement | TLS termination | Certificate storage and renewal | Upgraded connections | Web-node exposure | Operational trade-off |
|---|---|---|---|---|---|
| One web node behind Nginx | Nginx on port 443 | Host certificate manager; reload Nginx after renewal | Nginx must handle /hijack upgrades |
Can remain internal | Smallest moving surface and simplest diagnosis |
| Multiple web nodes behind Nginx or a load balancer | Public proxy or load-balancer layer | Owned by that TLS layer | Every hop must preserve upgrade headers | Web nodes can remain private | Requires shared PostgreSQL state and consistent public URL |
| Concourse-managed Let’s Encrypt | Concourse web node | Concourse stores the key and certificate in its database | Any proxy in front still needs upgrade handling | Web node must be reachable for ACME validation | Database encryption becomes imperative; often unnecessary when Nginx already terminates TLS |
| Nginx to an HTTPS upstream | Nginx for the public endpoint, with TLS again upstream | Separate certificates may exist on each hop | Upgrade headers and proxy TLS settings must both be correct | Web node remains private | More encryption and verification work than the common HTTP-upstream layout |
Support multiple Concourse web nodes
When scaling the web tier, put the public URL at the load balancer or reverse-proxy layer and make every web node use the same external URL. The web nodes must point to the same PostgreSQL database so they share Concourse state. The proxy must be able to route ordinary API traffic and the hijack connection to a healthy web node; otherwise a login can succeed on one node while an intercept is sent to another node that cannot continue it.
Apply the same certificate, forwarded-header, and upgrade configuration to every public proxy path. A configuration that works on a single Nginx host can fail after adding a second proxy if that additional hop removes Upgrade, rewrites the host, or reports an HTTP scheme.
Validate the installation in a safe order
- Check Nginx syntax: run
nginx -t. Correct syntax errors, missing include files, unreadable certificate paths, and key-permission errors before reloading. - Reload Nginx: use the reload mechanism supplied by your operating system or service manager. A successful syntax check does not activate a changed configuration until Nginx reloads.
- Open the public HTTPS address: request
https://ci.example.comand confirm that the Concourse UI loads without a redirect to the internal host or to HTTP. - Inspect the certificate: in a browser or TLS inspection tool, verify the hostname, expiration, and complete chain. Check the certificate actually served after the reload, not only the file on disk.
- Authenticate with
fly: target the HTTPS address represented byCONCOURSE_EXTERNAL_URLand complete a normal login. - Run an intercept: perform a representative
fly interceptand confirm that the upgraded connection remains open and interactive. - Read both log sets: review Nginx and Concourse logs for redirect loops, upstream connection failures, certificate-handshake errors, or disconnects at the moment of each test.
Run the checks again after a certificate renewal and after any change to a load balancer, DNS record, web-node address, or proxy include file. The exact service reload command varies by operating system, so use the command appropriate to your deployment rather than assuming a particular init system.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot by symptom
The browser redirects to HTTP or an internal hostname
Check CONCOURSE_EXTERNAL_URL first. It must contain the public HTTPS scheme and DNS name. Then confirm that the normal location forwards Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Protocol. A missing or overwritten header makes the web node reconstruct links from the internal request it received.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Login starts but the callback fails
Compare the callback host and scheme with the browser address and the external URL setting. Aliases are a frequent source of mismatch: use one canonical hostname for DNS, the certificate, the browser, fly, and Concourse’s external URL.
The dashboard works but fly intercept hangs or disconnects
Inspect the location ~ /hijack$ block. It needs both upgrade headers and the same forwarded host and scheme headers as the normal location. If another proxy sits in front of Nginx, verify that it also permits upgraded connections. Check the Nginx error log and the Concourse web log at the time of the failed intercept.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesClients report a certificate warning
Confirm that the certificate’s names include the exact public hostname, that the leaf certificate is followed by the intermediate chain, and that Nginx is serving the intended file after reload. Also check that the key belongs to the certificate and that Nginx can read both files.
Nginx returns a gateway or upstream error
Test reachability from the Nginx host to the configured Concourse address and port. Check for a stopped web node, a wrong internal DNS name, a blocked firewall path, or a listener bound only to an address Nginx cannot reach. The certificate can be perfectly valid while the proxy still cannot connect to its upstream.
A renewed certificate is not visible
Check the certificate-management job, confirm that the files changed, and reload Nginx. Inspect the public endpoint again rather than relying on file timestamps. If Nginx cannot read the renewed key or the renewal process replaced a symlink unexpectedly, the reload will fail or the old workers will continue serving the previous certificate.
Security and operations checklist
- Use the exact public HTTPS URL in
CONCOURSE_EXTERNAL_URL. - Keep the private key inaccessible to untrusted users and processes.
- Serve the complete certificate chain, with intermediates after the leaf.
- Limit negotiated TLS versions to versions supported by the current Nginx/OpenSSL stack; the example uses TLS 1.2 and TLS 1.3.
- Preserve the forwarded host and scheme headers in both proxy locations.
- Preserve
UpgradeandConnection: upgradefor/hijack. - Test the dashboard, authentication,
fly, and a livefly intercept, not just a TCP connection to port 443. - Monitor certificate expiry and have the renewal process reload Nginx.
- Review Nginx and Concourse logs after configuration changes and failed sessions.
- If using Concourse-managed certificates, encrypt the database that stores the key material.
- For several web nodes, use one PostgreSQL database and place the public URL and TLS policy at the proxy or load-balancer layer.
Why this arrangement is the practical default
Nginx is already designed to be the Internet-facing TLS endpoint, so it keeps certificate files, protocol policy, HSTS, and renewal hooks in one edge service. Concourse can then stay on an internal listener while still generating correct HTTPS links because its external URL and forwarded headers describe the client-facing address. The one special case is the hijack stream: treating it as an ordinary HTTP request is enough for the UI but not for an interactive intercept. A separate upgrade-aware location closes that gap.
Once the public name, certificate chain, external URL, forwarded headers, and hijack upgrade path all agree, the secure path is straightforward to operate. Future failures can then be isolated to one of three layers: certificate and TLS negotiation at Nginx, ordinary proxying and redirects between Nginx and Concourse, or upgraded-session handling for fly intercept.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
