system service►Atlassian►jira https

Atlassian jira https

jira SSL设置

  1. 停止服务

    1
    2
    3
    [root@jira app]# systemctl stop jira
    或者
    [root@jira app]# /etc/init.d/jira stop

  2. 修改tomcat server.conf配置文件

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    [root@jira app]# vim /mnt/app/jira/conf/server.xml
    <Connector port="8080"
               maxThreads="150"
               minSpareThreads="25"
               connectionTimeout="20000"

               enableLookups="false"
               maxHttpHeaderSize="8192"
               protocol="HTTP/1.1"
               useBodyEncodingForURI="true"
               redirectPort="8443"
               acceptCount="100"
               disableUploadTimeout="true"
               bindOnInit="false"

               proxyName="jira"
               proxyPort="443"
               scheme="https"
               secure="true"/>
    和
    <Context path="/jira" docBase="${catalina.home}/atlassian-jira" reloadable="false" useHttpOnly="true">

  3. 启动服务

    1
    2
    3
    [root@jira app]# systemctl start jira
    或者
    [root@jira app]# /etc/init.d/jira start

  4. nginx ssl key存放位置

    1
    2
    3
    [root@nginx ~]# ls -1 /mnt/app/nginx/conf/ssl/*
    /mnt/app/nginx/conf/ssl/jira.crt
    /mnt/app/nginx/conf/ssl/jira.key

  5. nginx 主配置文件

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    [root@nginx ~]# cat /mnt/app/nginx/conf/nginx.conf
    user nginx nginx;
    worker_processes  8;
    worker_cpu_affinity 00000001 00000010 00000100 00001000 00010000 00100000 01000000 10000000;
    worker_rlimit_nofile 102400;

    events {
      use epoll;
      worker_connections  102400;
    }

    http {
      include              mime.types;
      default_type         application/octet-stream;
      sendfile             on;
      keepalive_timeout    65;
      server_tokens        off;
      client_max_body_size 30m;
      client_header_buffer_size 16k;
      large_client_header_buffers 4 32k;

      gzip                 on;
      gzip_vary            on;
      gzip_min_length      1k;
      gzip_buffers         4  16k;
      gzip_http_version    1.0;
      gzip_comp_level      5;
      gzip_types text/plain application/x-javascript text/css application/xml  image/jpeg image/png image/gif;

      log_format  main  '$remote_addr $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent '
                          '"$http_user_agent" $http_x_forwarded_for $request_time $upstream_response_time';
      error_log /mnt/log/nginx/nginx_error.log ;

      include /mnt/app/nginx/conf/vhost/*.conf;
    }

    stream {
      include /mnt/app/nginx/conf/stream/*.conf;
    }

  6. nginx jira 虚拟主机配置文件

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    [root@nginx ~]# cat /mnt/app/nginx/conf/vhost/jira.conf
    server {
      listen       80;
      server_name  jira.ops.com;

      return 301 https://$host$request_uri;
    }


    server {
      listen 443 ssl;
      server_name  jira;
      access_log   /mnt/log/nginx/jira.ops.com.access.log  main;
      error_log    /mnt/log/nginx/jira.ops.com.error.log;

      ssl on;
      ssl_certificate /mnt/app/nginx/conf/ssl/jira.crt;
      ssl_certificate_key /mnt/app/nginx/conf/ssl/jira.key;
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
      ssl_prefer_server_ciphers on;
      ssl_session_cache shared:SSL:10m;
      ssl_session_timeout  10m;

      location / {
        rewrite ^/ https://jira.ops.com/jira/;
      }

      location /jira {
        proxy_set_header        Host $host:$server_port;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_redirect          http:// https://;
        proxy_pass              http://10.10.10.11:8080/jira;
        client_max_body_size    10M;
        proxy_set_header        X-Forwarded-Host $host;
        proxy_set_header        X-Forwarded-Server $host;
        # Required for new HTTP-based CLI
        proxy_http_version 1.1;
        proxy_request_buffering off;
      }
    }

  7. nginx reload

    1
    2
    [root@nginx ~]# /mnt/app/nginx/sbin/nginx -c /mnt/app/nginx/conf/nginx.conf -t
    [root@nginx ~]# /mnt/app/nginx/sbin/nginx -c /mnt/app/nginx/conf/nginx.conf -s reload

  8. 验证: 输入域名”jira.ops.com”查看是否自动跳转为https