OSLC Connect for Jira Cloud - Using a Reverse Proxy

Using a Reverse Proxy

Decide early. Whether or not to use a reverse proxy has a direct impact on the public URL of the Broker. OSLC links are stored in Jira using that URL, so changing it later will break all existing links. This decision must be made before going live.

Any standard reverse proxy can be used in front of the Broker (e.g. Nginx, HAProxy). Refer to the documentation of the chosen reverse proxy for configuration details (virtual hosts, SSL certificates, proxy pass rules).

Why a Reverse Proxy is Strongly Recommended

For production deployments, it is strongly recommended to place a reverse proxy in front of Tomcat rather than exposing Tomcat directly to the internet. The main reasons are:

DDoS protection: Reverse proxies can rate-limit incoming requests, absorb traffic spikes, and apply connection throttling, significantly reducing the impact of distributed denial-of-service attacks on the Broker.
TLS termination: The reverse proxy handles HTTPS, simplifying certificate management and offloading SSL processing from Tomcat.
Security hardening: The reverse proxy acts as a shield, hiding internal infrastructure details and allowing fine-grained access control rules to be applied before requests reach the application.
Standard ports: The reverse proxy can expose the Broker on standard ports (443) while Tomcat continues to run on its internal port.

Impact on the Broker URL

The Broker URL is the public base URL used to construct all OSLC links. This URL is stored persistently in Jira.

When a reverse proxy is in use, the Broker URL is the URL of the reverse proxy — not the internal Tomcat URL. For example:

Without reverse proxy: https://your-server:8443/oslc-connect-jira/ (Tomcat URL)
With reverse proxy: https://your-server/oslc-connect-jira/ (reverse proxy URL, forwarded to Tomcat internally)

Throughout this guide, https://your-server:your-port/ refers to the public-facing URL of the Broker. If a reverse proxy is in use, this is the reverse proxy URL. If Tomcat is exposed directly, this is the Tomcat URL.

The Broker URL is also the URL required for license generation so make sure to provide this URL when requesting your license.