Free tools Windows power users keep installed
One-click scans. No signup required.
Put Nginx in front of Jenkins as the public HTTPS endpoint, terminate TLS at Nginx, and proxy the request to Jenkins’ local HTTP listener. Jenkins must receive the original host, client address, and https scheme through forwarded headers; otherwise it can create HTTP redirects, incorrect links, failed WebSocket connections, or a reverse-proxy warning. The working pattern is Nginx on 443 with a certificate, Jenkins on 127.0.0.1:8080, matching URL paths at both layers, and explicit handling for WebSocket upgrades and long-running CLI requests.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the reverse-proxy arrangement changes
A reverse proxy is an alternate HTTP or HTTPS provider that communicates with browsers on Jenkins’ behalf. In this design, visitors connect to https://jenkins.example.com, Nginx performs the TLS handshake, and Nginx forwards the request over the loopback interface to Jenkins. Jenkins does not need to expose its own HTTP listener to the public network.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The internal connection can remain HTTP because encryption is provided at the public boundary. That is safe only when the boundary is controlled and the Jenkins port is inaccessible from untrusted networks. Jenkins still needs to know that the original request was HTTPS, which is why X-Forwarded-Proto is essential.
- Browser to Nginx: HTTPS on port 443, using the certificate for the public Jenkins hostname.
- Nginx to Jenkins: HTTP, normally to
127.0.0.1:8080on the same host. - Jenkins’s view of the request: the public host, client address, original scheme, and WebSocket upgrade state supplied by Nginx headers.
This article assumes a single server running both processes. If Jenkins is on another machine, use its private address in the upstream and restrict that address with a firewall or private network; do not expose the Jenkins port broadly.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prerequisites and decisions to make first
Use a stable public hostname
Create a DNS record such as jenkins.example.com that resolves to the Nginx server. The hostname must match the certificate’s covered name and the Jenkins URL configured for administrators and users. Avoid switching between an IP address and a hostname: cookies, redirects, and generated links are host-sensitive.
Choose a root URL or a subpath
| Public address | Nginx location | Jenkins setting | Operational effect |
|---|---|---|---|
https://jenkins.example.com/ |
location / |
No prefix | Simplest routing and generally the least plugin-path complexity. |
https://example.com/jenkins/ |
location /jenkins/ |
--prefix=/jenkins |
Shares a hostname with other applications but requires exact path matching. |
The path must be identical at both layers. A root deployment must not acquire an accidental /jenkins prefix, and a subpath deployment must not let Nginx strip or add a slash that Jenkins does not expect.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Have a certificate and private key ready
Nginx needs a certificate chain and private key readable by the Nginx master process. The paths in the configuration below are examples; substitute the paths used by your certificate-management system. The Jenkins guidance does not require a particular certificate authority. Plan renewal before the first certificate expires and verify that Nginx reloads the renewed files successfully.
Confirm the Jenkins listener
Check that Jenkins is listening on the intended local address and port. A listener bound to 127.0.0.1:8080 cannot be reached from another host, which is desirable for a same-machine proxy. If Jenkins currently listens on every interface, change that binding or use firewall rules before publishing the HTTPS endpoint.
Configure Nginx for Jenkins
Start with the following pattern and change only the hostname, certificate paths, and upstream address. The absence of a trailing slash on proxy_pass is deliberate: adding one can rewrite paths and produce 404 errors in folders, plugins, or Blue Ocean-style URLs.
upstream jenkins {
keepalive 32;
server 127.0.0.1:8080;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
server {
listen 443 ssl;
server_name jenkins.example.com;
ssl_certificate /etc/letsencrypt/live/jenkins.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/jenkins.example.com/privkey.pem;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
}
}Why each directive matters
upstreamgives Nginx a named backend and keeps connections available for reuse. The example allows up to 32 keepalive connections.Hostpreserves the hostname that the browser requested. Jenkins uses it when constructing links and evaluating redirects.X-Real-IPandX-Forwarded-Forcarry the client address rather than making every request appear to originate from Nginx.X-Forwarded-Proto $schemetells Jenkins that the public request was HTTPS. On the TLS server,$schemeevaluates tohttps, even though the backend hop is HTTP.Upgrade,Connection, andproxy_http_version 1.1preserve WebSocket handshakes used by compatible agents and features.proxy_request_buffering offis important for Jenkins HTTP CLI requests, which can stream input and output instead of waiting for Nginx to buffer the complete request.- The 90-second connect, send, and read values provide a starting point. A long operation can need a larger read timeout; increase it for the affected location or server rather than masking unrelated failures with an unlimited value.
Some installations also need the original host and port explicitly separated. If Jenkins’s reverse-proxy monitor reports missing values, add the following inside the location block and reload Nginx:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-Port $server_port;Do not add header rewrites merely to silence a warning; use them when the public topology requires those values and verify that they contain the external host and port.
Add the HTTP-to-HTTPS redirect
Port 80 should not serve a second copy of Jenkins. Add a separate server block for the same hostname that preserves the complete request URI while redirecting to HTTPS:
server {
listen 80;
server_name jenkins.example.com;
return 301 https://$host$request_uri;
}Keep the redirect scoped to the Jenkins hostname. A broad catch-all redirect can accidentally move unrelated virtual hosts or interfere with an upstream load balancer. If another device already owns the public HTTP listener, enforce the equivalent host-specific redirect there and still pass the correct HTTPS scheme to the Jenkins-facing proxy.
Match Jenkins’s context path
Root deployment
For https://jenkins.example.com/, use location / and leave Jenkins’s prefix empty. This is the least complicated arrangement because links beginning at / map directly to the same URI on the backend.
Recommended Free Tools
Subpath deployment
For https://example.com/jenkins/, configure Jenkins with the prefix /jenkins and proxy the same path without rewriting it. On a Linux package installation, create a systemd override with:
sudo systemctl edit jenkinsIn the editor, set the environment value (the exact unit may already provide an environment section):
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Environment="JENKINS_PREFIX=/jenkins"Then use a matching Nginx location:
location /jenkins/ {
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://jenkins;
proxy_http_version 1.1;
proxy_request_buffering off;
proxy_connect_timeout 90;
proxy_send_timeout 90;
proxy_read_timeout 90;
}Restart Jenkins after changing its prefix, test the Nginx configuration, and reload Nginx. A trailing slash added to proxy_pass can strip /jenkins before forwarding, so leave the value as http://jenkins unless you have deliberately designed a rewrite and tested every generated URL.
Apply the configuration safely
- Save the server configuration in the location used by your distribution and enable it for Nginx.
- Run
nginx -t(often throughsudo). Fix every syntax, certificate-path, and duplicate-server-name error before reloading. - Reload Nginx rather than stopping it, so existing connections can finish:
sudo systemctl reload nginx. - If you changed the Jenkins prefix or listener, restart Jenkins and confirm it returns to its normal state before testing through the proxy.
- Restrict the backend port. Permit public access to 443 (and optionally 80 for redirects), but do not leave 8080 reachable from the internet.
Keep a tested rollback copy of the last working Nginx file. A syntax-valid configuration can still be functionally wrong, so make changes one group at a time: certificate, proxy headers, path, then timeout or buffering adjustments.
Validate HTTPS, redirects, and Jenkins behavior
Validation must cover more than the login page. Use a browser and an agent or CLI workload that reflects how your Jenkins installation is actually used.
- Open the public URL: the certificate should match the hostname, and the address bar should remain HTTPS.
- Follow navigation and login: inspect the final URL after authentication, opening a job, viewing a folder, and returning to the dashboard. Jenkins-generated links should use the public hostname and HTTPS scheme.
- Test the port-80 policy: request the HTTP hostname and confirm a single redirect to the equivalent HTTPS URI. Query strings and path components must survive.
- Exercise a WebSocket-dependent path: connect a representative inbound or WebSocket-capable agent, or use the Jenkins feature that depends on the upgrade. A normal page can work while upgrades fail.
- Run an HTTP CLI command: choose a command that streams enough data to expose buffering or timeout problems. A premature EOF or a hang points to proxy buffering or timeout settings.
- Inspect Jenkins’s reverse-proxy monitor: resolve any warning about host, forwarded scheme, port, or response/request rewriting before treating the migration as complete.
- Check direct access: from a separate network, confirm that 8080 is blocked. From the server itself, verify that Jenkins still responds on its intended local address.
When a long CLI operation ends early, increase proxy_read_timeout for the relevant proxy location. Keep request buffering disabled for Jenkins HTTP CLI traffic; changing only the timeout does not solve a request that Nginx is waiting to buffer.
Troubleshoot by symptom
Jenkins says the reverse-proxy setup is broken
Jenkins actively checks whether the proxy preserves the request and response information it needs. Confirm that the public request reaches the expected virtual host, that Host contains the Jenkins hostname, and that X-Forwarded-Proto is https. If the monitor specifically identifies host or port information, add and verify X-Forwarded-Host or X-Forwarded-Port as appropriate. Also check for another proxy or load balancer overwriting the values before they reach Nginx.
Redirects point to HTTP or users see mixed-content-looking links
This almost always means Jenkins believes the original request was HTTP. On the TLS server, use proxy_set_header X-Forwarded-Proto $scheme;; do not hard-code http. If TLS is terminated before Nginx, pass the upstream device’s trusted HTTPS indication into Nginx and ensure Nginx forwards that value consistently. Clear a stale browser redirect only after correcting the server-side scheme.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
WebSocket agents fail while ordinary pages work
Check all three upgrade requirements together: proxy_http_version 1.1, proxy_set_header Upgrade $http_upgrade, and the map-based Connection header. Confirm that the map is defined in the Nginx HTTP context, not inside a server or location block. A second proxy, firewall, or idle timeout can also terminate an otherwise valid upgrade.
CLI commands hang or end with premature EOF
Ensure proxy_request_buffering off is present in the Jenkins location and that the request is reaching the intended upstream. Raise proxy_read_timeout for operations that legitimately run longer than the current value. Review Nginx and Jenkins logs at the same timestamp to distinguish a proxy timeout from a Jenkins process that exited.
Folders, Blue Ocean-style pages, or plugins return 404
Compare the browser’s public path with the path Jenkins expects. Root deployments should use an empty prefix; subpath deployments must use the same prefix in Jenkins and Nginx. Remove an unintended trailing slash from proxy_pass, then retest a folder URL, a job URL, an asset URL, and a redirect after login. Do not fix one broken path with an ad-hoc rewrite before establishing whether the context prefix is wrong.
Nginx cannot read Jenkins web files
Some deployments ask Nginx to read files from a Jenkins web root. Jenkins documentation describes adding the Nginx or www-data user to the Jenkins group for that case. Apply least privilege: first determine whether direct file access is actually required, then inspect ownership and directory execute permissions, and grant only the minimum access needed. A reverse proxy that forwards requests to Jenkins normally does not need broad access to Jenkins’s private data directory.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The certificate appears valid but Nginx will not reload
Run the configuration test and read the exact error. Common causes are a missing intermediate chain, an unreadable private key, a path that changed during renewal, or a syntax error in the server block. Fix the file or permission issue, rerun the test, and reload only after it passes. Keep the old certificate available until the new configuration has been accepted.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Root host versus subpath: which is better?
| Decision factor | Root host | Subpath |
|---|---|---|
| Context-path complexity | Low; no Jenkins prefix is required. | Higher; Nginx and Jenkins must preserve the same prefix. |
| Certificate scope | Certificate covers the dedicated Jenkins hostname. | Certificate covers the shared hostname; other applications may use different paths. |
| Redirect behavior | Direct host-to-host redirects are straightforward. | Every redirect must retain the prefix and avoid slash rewrites. |
| Plugin compatibility | Usually easier because applications see the root path they expect. | Requires testing plugins and pages that construct absolute or root-relative URLs. |
| Operational simplicity | Best when you can dedicate a hostname. | Useful when DNS or certificate policy requires one shared hostname, at the cost of more routing checks. |
Choose the root host when you control DNS and want the fewest moving parts. Choose a subpath only when sharing a hostname provides a concrete operational benefit and you are prepared to test every plugin and generated link after the prefix change.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Ongoing security and maintenance
- Renew certificates before expiry: automate issuance where possible, then run
nginx -tand reload Nginx as part of the renewal hook. - Keep the backend private: monitor firewall rules after package changes or cloud-network changes so port 8080 does not become public accidentally.
- Audit forwarded headers: trust values only from the proxy path you control. Do not let an external client supply a misleading forwarding chain directly to Jenkins.
- Review logs: correlate Nginx status codes and upstream timings with Jenkins logs when an agent or CLI operation fails.
- Retest after upgrades: Jenkins, plugins, Nginx, and the certificate automation can each change connection, path, or reload behavior.
- Preserve configuration backups: keep the last known-good server block and the Jenkins service override so a failed change can be reversed quickly.
The most important operational check is not whether Nginx serves a certificate; it is whether Jenkins consistently understands the public URL, scheme, path, and connection type. Re-run the browser, WebSocket, CLI, and reverse-proxy-monitor checks after any change to those layers.
Frequently asked questions
Can Jenkins remain on HTTP behind an HTTPS Nginx proxy?
Yes, when the Jenkins listener is private and Nginx is the controlled TLS boundary. Forward X-Forwarded-Proto https so Jenkins generates secure links and redirects.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do I need to expose Jenkins port 8080?
No. A same-host deployment should normally bind Jenkins to 127.0.0.1:8080 and allow users through Nginx. A separate-host deployment should limit the upstream address to a private network and firewall it.
Why is the trailing slash on proxy_pass significant?
Nginx treats a URI-bearing proxy value as a path replacement. An unintended trailing slash can remove the Jenkins context path and cause 404 responses or malformed redirects. The Jenkins pattern uses proxy_pass http://jenkins; without that slash.
What should I increase when a long Jenkins command times out?
Increase Nginx’s proxy_read_timeout for the affected location after confirming that request buffering is disabled. Match the value to the longest legitimate period between upstream response bytes rather than setting an arbitrary unlimited timeout.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
