Reverse Proxy Configuration

Use the following a2enmod script to enable the headers, rewrite, proxy_http, ssl, and http2 modules:

$ a2enmod headers
$ a2enmod rewrite
$ a2enmod proxy_http
$ a2enmod ssl
$ a2enmod http2

Add the following directives to the VirtualHost section of a relevant .conf file:

Protocols h2 http/1.1

RequestHeader set X-Forwarded-Proto "https"

RewriteEngine on
AllowEncodedSlashes on

ProxyRequests off

ProxyPass / http://127.0.0.1:1111/
ProxyPassReverse / http://127.0.0.1:1111/

SSLEngine On
SSLCertificateFile <path_to_certificate>
SSLCertificateKeyFile <path_to_key>

Set the following variables to match your Hub configuration:

• Replace 1111 with the actual port number that your Hub server listens to.

• Set the value for the <path_to_certificate> to the location of the SSL/TLS certificate for your server.

• Set the value for the <path_to_key> to the location of the PEM-encoded private key file for the server certificate.

Add the additional HSTS header to the HTTPS VirtualHost directive. Max-age is measured in seconds.

# Guarantee HTTPS for 1 Year including subdomains
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Note that this header is only valid on a HTTPS VirtualHost.

Add a server-side redirect to upgrade non-HTTPS connections the first time the site is accessed. Add this to the non-HTTP VirtualHost.

[...]
ServerName myYouTrackService.com
Redirect permanent / https://myYouTrackService.com/

Replace myYouTrackService.com with the actual domain name of your YouTrack server.

Download and install the Application Request Routing (ARR) extension from the Microsoft website.

In IIS Manager, connect to the IIS server - in this case, localhost.

Highlight the server in the Connections pane.

Double-click URL Rewrite.

Click View server variables in the right pane.

Add the following server variables to the list:

HTTP_X_FORWARDED_HOST
HTTP_X_FORWARDED_SCHEME
HTTP_X_FORWARDED_PROTO

Set the response buffer threshold. For single web servers:

• Select the server in the Connections pane.

• Double-click Application Request Routing Cache.

• Click Server Proxy Settings under the Proxy heading in the Actions pane.

• Select the Enable proxy checkbox, set the Response buffer threshold to 0, then click Apply. Leave the default values in place.

For server farms:

• Select the YouTrack server farm in the Connections pane.

• Double-click the Proxy icon.

• In the Buffer Setting section of the form, set the Response buffer threshold to 0, then click Apply.

Deselect the Reverse rewrite host in response headers checkbox and click Apply.

In the Connections pane, under Sites, select Default Web Site.

Double-click the URL Rewrite feature, then click Add Rule(s) in the Actions pane.

Add a reverse proxy rule with the server name: localhost:1111 (replace with the real location and port of your YouTrack service).

Open the rule, check the rewrite URL, and add the following server variables:

• Set the HTTP_X_FORWARDED_HOST variable to {HTTP_HOST}.

• Set the HTTP_X_FORWARDED_SCHEME variable to https.

• Set the HTTP_X_FORWARDED_PROTO to https.

Make sure that anonymous authentication is enabled:

• In the Sites section of the Connections pane, select Default Web Site.

• Double-click Authentication, select Anonymous, then click Enable in the right pane.

Make sure that Dynamic Content Compression is disabled. The location of this setting varies by operating system.

In the Connections pane, under Sites, select Default Web Site.

Double-click the Request Filtering feature, then click Edit Feature Settings in the Actions pane.

Increase the values for the following parameters:

Add a new SSL binding to the Default Web Site.

• The address that the SSL binding listens to (Host URL) should match the YouTrack base URL.

• The certificate that you choose should correspond to the server DNS address.

Configure the HTTP Strict Transport Security (HSTS) settings for the Default Web Site

• Set the enabled attribute for the <hsts> to true.

• Specify a value for the max-age attribute. For example, 31536000 (one year, in seconds).

• Set the values for the includeSubDomains and redirectHttpToHttps to true as well.

For specific instructions, please refer to the ISS configuration reference.

Open the configuration file for your NGINX server. By default, the configuration file is named nginx.conf. The default directory is either /usr/local/nginx/conf, /etc/nginx, or /usr/local/etc/nginx.

You can find the exact location of the configuration file by entering nginx -V in a command line interface.

Increase the value for the worker_rlimit_nofile directive to a minimum value of 4096.

In the events section, increase the value for the worker_connections directive to a minimum value of 2048.

Update the server directive and add the proxy_set_header and proxy_pass directives in your configuration file. Use the following sample as a guide:

warning

Many sample NGINX configurations use an include directive that references a snippets/ssl-params.conf file. This file contains a set of common configuration parameters for SSL termination. If you choose to include this file rather than following the setup described below, you must change the value for the X-Frame-Options parameter in the referenced file from DENY to SAMEORIGIN. Otherwise, the reverse proxy interferes with the process that keeps users logged in to YouTrack.

For more information, see Users are periodically logged out of YouTrack.

server {
    listen 443 ssl http2;

    ssl_certificate <path_to_certificate>;
    ssl_certificate_key <path_to_key>;

    server_name localhost;

    add_header Strict-Transport-Security max-age=31536000;

    location / {
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        client_max_body_size 10m;

        proxy_http_version 1.1;
        proxy_pass http://youtrackmachine.domain.local:1111;
    }
    location /api/eventSourceBus {
        proxy_cache off;
        proxy_buffering off;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        proxy_set_header Connection '';
        chunked_transfer_encoding off;

        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_pass http://youtrackmachine.domain.local:1111;
    }
}

Set the following variables to match your YouTrack configuration:

• listen 443 is the port number that you specified in the --base-url parameter.

• proxy_pass http://youtrackmachine.domain.local:1111 is the path to your YouTrack server with the port that you specified with the -–listen-port command.

Save and close your configuration file.

Check for errors in your NGINX configuration by stopping and starting the server with the following commands:

sudo nginx -s stop
sudo nginx

Alternatively, you can reload the configuration with the following command:

sudo nginx -s reload

Use keytool to convert your current .jks file to the PKCS12 key store format .p12:

keytool -importkeystore -srckeystore oldkeystore.jks -destkeystore newkeystore.p12 -deststoretype PKCS12
Enter destination keystore password: [enter private key password from oldkeystore.jks, it will be password for newkeystore.p12]
Re-enter new password: [same as above]
Enter source keystore password: [enter password for oldkeystore.jks]
...
Enter key password for <key alias name> [enter private key password from oldkeystore.jks]
...

You will be required to enter a "destination keystore password". If your .jks keystore contains a private key with a password, then the "destination keystore password" should equal the password of the private key.

List the contents of the new key store file:

keytool -deststoretype PKCS12 -keystore newkeystore.p12 -list
Enter keystore password: [enter password for newkeystore.p12 provided on step 1]
...

Extract the .pem file (certificate) from the .p12 key store:

openssl pkcs12 -nokeys -in newkeystore.p12 -out certfile.pem
Enter Import Password: [enter password for newkeystore.p12 provided on step 1]
...

Extract the unencrypted key file from the .p12 key store:

openssl pkcs12 -nocerts -nodes -in newkeystore.p12 -out keyfile.key
Enter Import Password: [enter password for newkeystore.p12 provided on step 1]
...