Jenkins+Apache反向代理配置异常：访问出现403/404错误求助

运行中的AWS EC2实例，入站安全规则仅开放22和443端口。按以下配置部署Jenkins+Apache反向代理后，访问https://subdomain.domain.dev/jenkins先返回403错误，随后重定向到https://subdomain.domain.dev/login?from=%2Fjenkins并出现404错误。

当前配置 #

Jenkins配置（/etc/default/jenkins） #

HTTP_PORT=8080
NAME=jenkins
JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT --httpListenAddress=127.0.0.1 --prefix=/jenkins"

Apache配置（/etc/apache2/sites-enabled/subdomain.domain.dev-le-ssl.conf） #

<IfModule mod_ssl.c>
    <VirtualHost *:443>

            ServerAdmin email@domain
            ServerName subdomain.domain.dev
            ServerAlias www.subdomain.domain.dev

            DocumentRoot /var/www/subdomain.domain.dev

            ErrorLog ${APACHE_LOG_DIR}/error.log
            CustomLog ${APACHE_LOG_DIR}/access.log combined

            ProxyPass         /jenkins  http://127.0.0.1:8080/jenkins nocanon
            ProxyPassReverse  /jenkins  http://127.0.0.1:8080/jenkins
            ProxyPassReverse /jenkins http://subdomain.domain.dev/jenkins
            ProxyPassReverse /jenkins https://subdomain.domain.dev/jenkins
            ProxyRequests     Off
            ProxyPreserveHost On
            AllowEncodedSlashes NoDecode

            RequestHeader set X-Forwarded-Proto "https"
            RequestHeader set X-Forwarded-Port "443"

            <Proxy http://127.0.0.1:8080/jenkins*>
                    Order deny,allow
                    Allow from all
            </Proxy>


            Include /etc/letsencrypt/options-ssl-apache.conf        
            SSLCertificateFile /etc/letsencrypt/live/subdomain.domain.dev/fullchain.pem
            SSLCertificateKeyFile /etc/letsencrypt/live/subdomain.domain.dev/privkey.pem

    </VirtualHost>
 </IfModule>

ports.conf配置 #

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

日志与环境信息 #

Apache访问日志 #

162.158.227.119 - - [20/May/2023:17:09:38 +0000] "GET /jenkins HTTP/1.1" 403 5890 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"
162.158.227.119 - - [20/May/2023:17:09:39 +0000] "GET /login?from=%2Fjenkins HTTP/1.1" 404 525 "https://subdomain.domain.dev/jenkins" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"

• /var/log/apache2/error.log无错误日志
• sudo apache2ctl -t -D DUMP_VHOSTS输出：

VirtualHost configuration:
*:443                  subdomain.domain.dev (/etc/apache2/sites-enabled/subdomain.domain.dev-le-ssl.conf:2)

• 环境：Cloudflare Full Strict SSL/TLS模式，Let's Encrypt证书，OpenSSL 3.0.2

问题根源分析 #

1. 403错误：Apache旧版权限语法Order deny,allow可能因未启用mod_access_compat模块失效，或Jenkins未识别到正确的代理请求头导致拒绝访问。
2. 404错误：Jenkins重定向时未带上/jenkins前缀，生成的/login路径无法匹配代理规则，直接访问站点根目录不存在的资源。

分步解决步骤 #

步骤1：启用必要Apache模块 #

确保反向代理、请求头相关模块正常启用：

sudo a2enmod proxy proxy_http headers rewrite proxy_balancer proxy_connect proxy_html
sudo systemctl restart apache2

步骤2：修正Apache代理配置 #

更新虚拟主机配置，优化路径匹配规则与权限设置：

<IfModule mod_ssl.c>
    <VirtualHost *:443>

            ServerAdmin email@domain
            ServerName subdomain.domain.dev
            ServerAlias www.subdomain.domain.dev

            DocumentRoot /var/www/subdomain.domain.dev

            ErrorLog ${APACHE_LOG_DIR}/error.log
            CustomLog ${APACHE_LOG_DIR}/access.log combined

            # 给路径添加尾部斜杠，避免匹配歧义
            ProxyPass         /jenkins/  http://127.0.0.1:8080/jenkins/ nocanon
            ProxyPassReverse  /jenkins/  http://127.0.0.1:8080/jenkins/
            ProxyPassReverse  /jenkins/  https://subdomain.domain.dev/jenkins/
            ProxyRequests     Off
            ProxyPreserveHost On
            AllowEncodedSlashes NoDecode

            # 补充完整转发头，确保Jenkins识别HTTPS环境
            RequestHeader set X-Forwarded-Proto "https"
            RequestHeader set X-Forwarded-Port "443"
            RequestHeader set X-Forwarded-Host "subdomain.domain.dev"

            # 使用新版Apache权限语法替代旧规则
            <Proxy http://127.0.0.1:8080/jenkins/*>
                    Require all granted
            </Proxy>

            Include /etc/letsencrypt/options-ssl-apache.conf        
            SSLCertificateFile /etc/letsencrypt/live/subdomain.domain.dev/fullchain.pem
            SSLCertificateKeyFile /etc/letsencrypt/live/subdomain.domain.dev/privkey.pem

    </VirtualHost>
 </IfModule>

步骤3：更新Jenkins配置 #

修改/etc/default/jenkins，添加代理适配参数：

HTTP_PORT=8080
NAME=jenkins
JENKINS_ARGS="--webroot=/var/cache/$NAME/war --httpPort=$HTTP_PORT --httpListenAddress=127.0.0.1 --prefix=/jenkins --sessionTimeout=86400 --handlerCountMax=300"
# 追加代理识别参数
JENKINS_ARGS="$JENKINS_ARGS --prefix=/jenkins"

重启Jenkins生效：

sudo systemctl restart jenkins

步骤4：验证Cloudflare配置 #

确认Cloudflare SSL/TLS模式为Full Strict，域名解析指向EC2公网IP，且未对/jenkins路径设置缓存规则。

步骤5：测试访问 #

重启Apache与Jenkins后，访问https://subdomain.domain.dev/jenkins，检查是否能正常进入登录页面。

内容的提问来源于stack exchange，提问作者johnny68