1

I have JIRA and Nginx running on the same server with Nginx installed to serve as a reverse proxy. From what I learnt from various sources, in the server.xml file, I must add an address="127.0.0.1" attribute so that Tomcat does not listen to outside IPs. But once I add that to my 8080 and 8443 connectors, things stop working i.e., the JIRA site becomes inaccessible. Browser displays Connection refused / connection timed out errors.

Here is server.xml file configuration for Tomcat.

<Connector port="8080" 
address="127.0.0.1" 
maxThreads="150" 
minSpareThreads="25" 
connectionTimeout="20000" 
enableLookups="false" 
maxHttpHeaderSize="8192" 
protocol="HTTP/1.1" 
useBodyEncodingForURI="true" 
acceptCount="100" 
redirectPort="8443" 
disableUploadTimeout="true" 
proxyName=<FQDN> 
proxyPort="80"/>

<Connector port="8443" 
address="127.0.0.1" 
SSLEnabled="true" 
acceptCount="100" 
clientAuth="false" 
connectionTimeout="20000" 
disableUploadTimeout="true" 
enableLookups="false" 
keyAlias=<value> 
keystoreFile=<jks file> 
keystorePass=<password> 
keystoreType="JKS" 
maxHttpHeaderSize="8192" 
maxSpareThreads="75" 
maxThreads="150" 
minSpareThreads="25"  
protocol="org.apache.coyote.http11.Http11Protocol" 
scheme="https" 
secure="true" 
sslProtocol="TLS" 
useBodyEncodingForURI="true"/>

and the Nginx server configuration in sites-enabled linked to sites-available folder -

    server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;
    server_name <FQDN>;
    location / {
    proxy_pass http://127.0.0.1; #I have tried FQDN, real IP, :8080 suffix etc. but the response didn't change
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
}
}

What is wrong in my approach? It's largely derived from https://confluence.atlassian.com/jirakb/integrating-jira-with-nginx-426115340.html except for adding the address attribute. The HTTPS connector block was derived (I guess it was auto-generated when I configured it) from Atlassian's standard SSL enabling instructions.

Update 21 April: Here is my nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

Update 22 April I tried running curl -v FQDN and got this message in the error log. Terminal showed me 502 Bad gateway -

connect() failed (111: Connection refused) while connecting to upstream, client: <IP Address>, server: <FQDN>, request: "GET / HTTP/1.1", upstream: "http://<IP>:8080/", host: <FQDN> 
10
  • Pls show full nginx conf Apr 21, 2016 at 11:39
  • It appears that you are missing the ProxyPass lines. Is there more to your nginx configuration that you haven't shown?
    – prateek61
    Apr 21, 2016 at 11:52
  • @user1700494 added those details
    – Chethan S.
    Apr 21, 2016 at 12:51
  • @prateek61, I had it earlier but it didn't seem to help. So was trying out various options.
    – Chethan S.
    Apr 21, 2016 at 12:51
  • Try adding that block back in, but update proxy_pass http://jira-hostname:8080/jira; to be proxy_pass http://127.0.0.1:8080/jira;.
    – prateek61
    Apr 21, 2016 at 12:55

2 Answers 2

1

Make sure your proxy from Nginx is going to "127.0.0.1" instead of your server's / site's hostname or IP.

If this is done, you could have an issue with the Tomcat connector being on IPV4 (forced by 127.0.0.1) while Nginx is trying to get to it on the IPv6 stack.

3
  • can you provide me some tips about how that can be done? I'm a bit new to all these.
    – Chethan S.
    Apr 22, 2016 at 7:17
  • Share with us the contents of the referenced "include /etc/nginx/sites-enabled/*;" We need to see how you've configured your proxy. Apr 22, 2016 at 7:20
  • I just updated my "Nginx server configuration in sites-enabled linked to sites-available folder" with the latest one I am using. That's the only file present in sites-available sym linked to sites-enabled.
    – Chethan S.
    Apr 22, 2016 at 7:27
1

If nginx is running, but cannot connect to its upstream server, e.g., to tomcat, then you'd be getting a 50x-style error, NOT a connection refused one.

Browser reports site refused to connect. ERR_CONNECTION_REFUSED – Chethan S. Apr 21 at 15:34

This means that you cannot connect to nginx in the first place. Are you sure it is running?

Best way to troubleshoot what's going on is to see what's running on your system, and on what ports and IP-addresses. For example:

# lsof | fgrep -e LISTEN | fgrep -e tomcat -e nginx
nginx     25509              root   15u     IPv4           55825524      0t0        TCP *:http (LISTEN)
nginx     25529          www-data   15u     IPv4           55825524      0t0        TCP *:http (LISTEN)
nginx     25530          www-data   15u     IPv4           55825524      0t0        TCP *:http (LISTEN)
nginx     25531          www-data   15u     IPv4           55825524      0t0        TCP *:http (LISTEN)
nginx     25532          www-data   15u     IPv4           55825524      0t0        TCP *:http (LISTEN)

Make sure you see both tomcat and nginx in there.

Another approach would be to configure a firewall (e.g., iptables) to deny any attempts to connect to ports 8080 and 8443 from the outside, or only allow outside connections to ports 22 and 80/443 in the first place.

5
  • I get this output for the lsof command nginx 21140 root 6u IPv4 815458 0t0 TCP *:http (LISTEN) nginx 21142 nginx 6u IPv4 815458 0t0 TCP *:http (LISTEN) I suppose Tomcat is not listed since it probably shows as java and not Tomcat. Tomcat is actually running since I'm able to access the JIRA site without any issues.
    – Chethan S.
    Apr 28, 2016 at 4:28
  • @ChethanS., the information you provide about your situation is very inconsistent and quite contradictory -- how exactly are you able to access JIRA (from under tomcat) if tomcat is only listening on 127.0.0.1? tomcat usually runs from under user tomcat, so, if you're not seeing it, chances are, it's not installed correctly.
    – cnst
    Apr 28, 2016 at 6:41
  • Sorry for the confusion. Actually, to make the site accessible until I find a solution, I removed address=127.0.0.1 from the server.xml file. In this case, where I have Jira installed, it takes care of Tomcat installation. Therefore, even the server.xml file is inside /opt/ folder hierarchy.
    – Chethan S.
    Apr 28, 2016 at 7:54
  • @ChethanS., so, what steps do you take to get the things running? Are they all running within a single operating system instance?
    – cnst
    Apr 28, 2016 at 18:58
  • yes, both Tomcat and Nginx are running in the same server.
    – Chethan S.
    Apr 29, 2016 at 4:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .