Skip to content

Commit 82c013a

Browse files
ryanaslettclaudeCopilot
authored
ansible: capture jenkins-nginx config for ci and ci-release (#4486)
* ansible: capture jenkins-nginx config for ci and ci-release Adds a jenkins-nginx role that reproduces the nginx reverse proxy already running by hand in front of the Jenkins masters on ci.nodejs.org and ci-release.nodejs.org: package install, dhparam, proxy_cache_path config, per-host site config, and (ci.nodejs.org only) the /server_status stub_status page. Templates and files were captured from the live hosts and verified byte-for-byte against the running config (aside from one straight- quote fix to an already mismatched-quote typo in the ci.nodejs.org comment). This is a management-only change: no nginx behavior changes on either host. This is the first PR in a stack leading up to automating certbot for these hosts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org> * Create SSL directory for Nginx Ensure the SSL directory for Nginx exists with proper permissions. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Ryan Aslett <raslett@linuxfoundation.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 4213f0a commit 82c013a

7 files changed

Lines changed: 287 additions & 0 deletions

File tree

‎ansible/playbooks/jenkins/host/create.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,16 @@
1010

1111
roles:
1212
- bootstrap
13+
- package-upgrade
1314
- baselayout
1415

1516
tasks:
1617
# - name: place init script
18+
19+
- hosts: infra-digitalocean-ubuntu2204-x64-1 # ci.nodejs.org
20+
roles:
21+
- { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci.nodejs.org', jenkins_nginx_status_page: true }
22+
23+
- hosts: infra-ibm-ubuntu2404-x64-1 # ci-release.nodejs.org
24+
roles:
25+
- { role: jenkins-nginx, jenkins_nginx_fqdn: 'ci-release.nodejs.org' }

‎ansible/roles/jenkins-nginx/files/dhparam.pem‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-----BEGIN DH PARAMETERS-----
2+
MIICCAKCAgEApD4ksbd6LDk6C+qy/9n9dtMEeoEN07TMpgfTRgQxaHR5XVLD5/89
3+
+mQyOFzSwxVXSWEg+bVSOsL1DDZg9DrvNNe+2yOI5eIYNTH0bWGoK0H/BsaPeHXf
4+
UoNWp785VT2afImKPTVs7cwNiIFUNKh4bOYjEWKswM7eSWgEqYF2QqZOeJIbDuXg
5+
9tiEp0fe4U8Qhyg9GsCBd9LfQRdaoiOiWFuMx66IrBKLWAYV2fBj1M9Q6+ofXOnS
6+
xKgRWMK6tm5Va72lmrXxr4poFIdzv3VUjczOXwchh4IRgWj50zrYVxiaMMX5OJre
7+
SBeNgRZ0I4cLu1JdboFDFjMPpqOvG58cY5+rLLc+ffBnc+ybXVL+BxiA9KGxu2mY
8+
3Bscgd7slU2TXaHtiP7+MEnxQsO6JYrUrPpuuC14IzHmCH1mmd5oOy0iJQJesP4c
9+
SH+0V0flLtI8RcSZIMTlYqXegMBgVIS8p8fOzL8IGgeHXwe5DIEMv0VYtyB1J2sl
10+
cEjEZW+wOsDvJh4qk9i05VtQOg4f1PCaelLc+fE3zf+vGTCvX09JBFrX/m/VQ/2c
11+
3EdGRNBa6aGyGXdagd1mAp6abwCcb87ciL35Ho68blgIMLZWsjX0FeJT/hHOjNQu
12+
1egu4mrSkZMQ5Nq9ExH/EfaQKkzCozd5rUf+AJESfoEJH40WMjTmZ3sCAQI=
13+
-----END DH PARAMETERS-----

‎ansible/roles/jenkins-nginx/files/jenkins-static.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
proxy_cache_path /var/lib/nginx/jenkins-cache levels=1:2 keys_zone=jenkins-static:10m inactive=24h max_size=5g;

‎ansible/roles/jenkins-nginx/files/status.conf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
server {
2+
3+
listen localhost:80;
4+
location /server_status {
5+
stub_status on;
6+
7+
access_log off;
8+
allow 127.0.0.1;
9+
deny all;
10+
}
11+
}

‎ansible/roles/jenkins-nginx/tasks/main.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
3+
#
4+
# installs and configures the nginx reverse proxy that fronts a Jenkins
5+
# master, matching the config already running by hand on ci.nodejs.org
6+
# and ci-release.nodejs.org.
7+
#
8+
# expects:
9+
# jenkins_nginx_fqdn: the hostname this proxy serves (e.g. ci.nodejs.org).
10+
# Selects the site template `{{ jenkins_nginx_fqdn }}.conf.j2`.
11+
# jenkins_nginx_status_page: whether to install the localhost-only
12+
# `/server_status` stub_status site (only ci.nodejs.org has this today).
13+
# Defaults to false.
14+
#
15+
16+
- name: jenkins-nginx | install nginx
17+
package:
18+
name: nginx
19+
state: present
20+
21+
- name: jenkins-nginx | ensure conf.d cache path config
22+
copy:
23+
src: jenkins-static.conf
24+
dest: /etc/nginx/conf.d/jenkins-static.conf
25+
mode: 0644
26+
27+
- name: jenkins-nginx | ensure nginx ssl directory
28+
file:
29+
path: /etc/nginx/ssl
30+
state: directory
31+
mode: 0755
32+
33+
- name: jenkins-nginx | ensure dhparam
34+
copy:
35+
src: dhparam.pem
36+
dest: /etc/nginx/ssl/dhparam.pem
37+
mode: 0644
38+
39+
- name: jenkins-nginx | copy site config to sites-available
40+
template:
41+
src: "{{ jenkins_nginx_fqdn }}.conf.j2"
42+
dest: /etc/nginx/sites-available/jenkins-iojs
43+
mode: 0644
44+
45+
- name: jenkins-nginx | symlink site into sites-enabled
46+
file:
47+
src: /etc/nginx/sites-available/jenkins-iojs
48+
dest: /etc/nginx/sites-enabled/jenkins-iojs
49+
state: link
50+
51+
- name: jenkins-nginx | install status page
52+
copy:
53+
src: status.conf
54+
dest: /etc/nginx/sites-enabled/status.conf
55+
mode: 0644
56+
when: jenkins_nginx_status_page | default(false)
57+
58+
- name: jenkins-nginx | enable and start nginx
59+
service:
60+
name: nginx
61+
state: started
62+
enabled: yes

‎ansible/roles/jenkins-nginx/templates/ci-release.nodejs.org.conf.j2‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
server {
2+
listen 80;
3+
server_name {{ jenkins_nginx_fqdn }};
4+
return 301 https://{{ jenkins_nginx_fqdn }}$request_uri;
5+
}
6+
7+
server {
8+
listen 443 default_server ssl http2;
9+
server_name {{ jenkins_nginx_fqdn }};
10+
11+
ssl_certificate ssl/nodejs_chained.crt;
12+
ssl_certificate_key ssl/nodejs.key;
13+
14+
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
15+
ssl_prefer_server_ciphers on;
16+
ssl_dhparam ssl/dhparam.pem;
17+
ssl_session_timeout 5m;
18+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
19+
ssl_session_cache shared:SSL:50m;
20+
21+
ssl_stapling on;
22+
ssl_stapling_verify on;
23+
ssl_trusted_certificate ssl/nodejs_chained.crt;
24+
resolver 8.8.4.4 8.8.8.8 valid=300s;
25+
resolver_timeout 10s;
26+
27+
add_header Strict-Transport-Security max-age=15552000;
28+
29+
access_log /var/log/nginx/jenkins-iojs-access.log;
30+
error_log /var/log/nginx/jenkins-iojs-error.log;
31+
32+
gzip on;
33+
gzip_static on;
34+
gzip_disable "MSIE [1-6]\.";
35+
default_type text/html;
36+
gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
37+
38+
location /static/ {
39+
proxy_set_header Host $host;
40+
proxy_set_header X-Real-IP $remote_addr;
41+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
42+
proxy_set_header X-Forwarded-Proto $scheme;
43+
44+
proxy_cache jenkins-static;
45+
proxy_cache_valid 200 1y;
46+
proxy_cache_use_stale error timeout invalid_header updating
47+
http_500 http_502 http_503 http_504;
48+
49+
expires 1y;
50+
51+
proxy_pass http://localhost:8080;
52+
proxy_read_timeout 90;
53+
}
54+
55+
location / {
56+
57+
proxy_set_header Host $host;
58+
proxy_set_header X-Real-IP $remote_addr;
59+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
60+
proxy_set_header X-Forwarded-Proto $scheme;
61+
62+
proxy_pass http://localhost:8080;
63+
proxy_read_timeout 90;
64+
65+
# Hide jenkins headers because reasons
66+
proxy_hide_header X-Hudson-CLI-Port;
67+
proxy_hide_header X-Jenkins-CLI-Port;
68+
proxy_hide_header X-Jenkins-CLI2-Port;
69+
70+
proxy_redirect http://localhost:8080 https://{{ jenkins_nginx_fqdn }};
71+
}
72+
73+
location ~ ^/cli {
74+
return 403;
75+
}
76+
77+
location /theme/ {
78+
alias /var/lib/jenkins/theme/;
79+
}
80+
}

‎ansible/roles/jenkins-nginx/templates/ci.nodejs.org.conf.j2‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
server {
2+
listen *:80;
3+
listen [::]:80 ipv6only=on;
4+
server_name {{ jenkins_nginx_fqdn }};
5+
6+
keepalive_timeout 60;
7+
server_tokens off;
8+
9+
resolver 8.8.4.4 8.8.8.8 valid=300s;
10+
resolver_timeout 10s;
11+
12+
access_log /var/log/nginx/jenkins-iojs-access.log;
13+
error_log /var/log/nginx/jenkins-iojs-error.log;
14+
15+
gzip on;
16+
gzip_static on;
17+
gzip_disable "MSIE [1-6]\.";
18+
default_type text/html;
19+
gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
20+
21+
location /downloads/ {
22+
alias /home/downloads/www/;
23+
autoindex on;
24+
}
25+
26+
location / {
27+
rewrite ^ https://{{ jenkins_nginx_fqdn }}$request_uri permanent;
28+
}
29+
30+
index index.html;
31+
}
32+
33+
server {
34+
listen 443 default_server ssl spdy;
35+
server_name {{ jenkins_nginx_fqdn }};
36+
37+
ssl_certificate ssl/nodejs_chained.crt;
38+
ssl_certificate_key ssl/nodejs.key;
39+
40+
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";
41+
ssl_prefer_server_ciphers on;
42+
ssl_dhparam ssl/dhparam.pem;
43+
ssl_session_timeout 5m;
44+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
45+
ssl_session_cache shared:SSL:50m;
46+
47+
ssl_stapling on;
48+
ssl_stapling_verify on;
49+
ssl_trusted_certificate ssl/nodejs_chained.crt;
50+
resolver 8.8.4.4 8.8.8.8 valid=300s;
51+
resolver_timeout 10s;
52+
53+
access_log /var/log/nginx/jenkins-iojs-access.log;
54+
error_log /var/log/nginx/jenkins-iojs-error.log;
55+
56+
gzip on;
57+
gzip_static on;
58+
gzip_disable "MSIE [1-6]\.";
59+
default_type text/html;
60+
gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;
61+
62+
location /downloads/ {
63+
alias /home/downloads/www/;
64+
autoindex on;
65+
}
66+
67+
location /static/ {
68+
proxy_set_header Host $host;
69+
proxy_set_header X-Real-IP $remote_addr;
70+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
71+
proxy_set_header X-Forwarded-Proto $scheme;
72+
73+
proxy_cache jenkins-static;
74+
proxy_cache_valid 200 1y;
75+
proxy_cache_use_stale error timeout invalid_header updating
76+
http_500 http_502 http_503 http_504;
77+
78+
expires 1y;
79+
80+
proxy_pass http://localhost:8080;
81+
proxy_read_timeout 240;
82+
}
83+
84+
location /theme/ {
85+
alias /var/lib/jenkins/theme/;
86+
expires max;
87+
}
88+
89+
location ~ ^/cli {
90+
return 403;
91+
}
92+
93+
location / {
94+
95+
proxy_set_header Host $host;
96+
proxy_set_header X-Real-IP $remote_addr;
97+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
98+
proxy_set_header X-Forwarded-Proto $scheme;
99+
100+
# Fix the "It appears that your reverse proxy set up is broken" error.
101+
proxy_pass http://localhost:8080;
102+
proxy_read_timeout 90;
103+
104+
# Hide jenkins headers because reasons
105+
proxy_hide_header X-Hudson-CLI-Port;
106+
proxy_hide_header X-Jenkins-CLI-Port;
107+
proxy_hide_header X-Jenkins-CLI2-Port;
108+
109+
proxy_redirect http://localhost:8080 https://{{ jenkins_nginx_fqdn }};
110+
}
111+
}

0 commit comments

Comments
 (0)