G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen yaz\u0131l\u0131m geli\u015ftirme d\u00fcnyas\u0131nda, S\u00fcrekli Entegrasyon (CI) ve S\u00fcrekli Teslimat (CD) s\u00fcre\u00e7leri, yaz\u0131l\u0131m kalitesini art\u0131rmak, geli\u015ftirme d\u00f6ng\u00fclerini h\u0131zland\u0131rmak ve ekiplerin daha verimli \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flamak i\u00e7in vazge\u00e7ilmez hale gelmi\u015ftir. Bu s\u00fcre\u00e7lerin merkezinde yer alan ara\u00e7lardan biri de Jenkins’tir. Jenkins, a\u00e7\u0131k kaynakl\u0131, g\u00fc\u00e7l\u00fc ve geni\u015fletilebilir bir otomasyon sunucusudur ve yaz\u0131l\u0131m projelerinin derlenmesi, test edilmesi ve da\u011f\u0131t\u0131lmas\u0131 gibi bir\u00e7ok g\u00f6revi otomatikle\u015ftirmek i\u00e7in kullan\u0131l\u0131r.<\/p>\n
Jenkins, CI\/CD boru hatlar\u0131n\u0131n olu\u015fturulmas\u0131na olanak tan\u0131yarak geli\u015ftiricilerin kod de\u011fi\u015fikliklerini s\u0131k s\u0131k entegre etmelerini, otomatik testler \u00e7al\u0131\u015ft\u0131rmalar\u0131n\u0131 ve da\u011f\u0131t\u0131mlar\u0131 otomatikle\u015ftirmelerini sa\u011flar. Bu, hatalar\u0131n erken a\u015famada tespit edilmesine, entegrasyon sorunlar\u0131n\u0131n azalt\u0131lmas\u0131na ve nihayetinde daha h\u0131zl\u0131 ve g\u00fcvenilir yaz\u0131l\u0131m teslimat\u0131na yol a\u00e7ar. Ancak, Jenkins sunucusunun do\u011frudan internete a\u00e7\u0131k bir \u015fekilde \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 g\u00fcvenlik ve performans a\u00e7\u0131s\u0131ndan ideal de\u011fildir. \u0130\u015fte bu noktada Nginx devreye girer.<\/p>\n
Nginx, y\u00fcksek performansl\u0131, a\u00e7\u0131k kaynakl\u0131 bir web sunucusu ve ters proxy sunucusudur. Y\u00fcksek trafikli web sitelerini ve uygulamalar\u0131n\u0131 y\u00f6netme yetene\u011fiyle bilinir. Jenkins gibi bir uygulama sunucusunun \u00f6n\u00fcne Nginx’i bir ters proxy olarak konumland\u0131rmak, uygulaman\u0131n g\u00fcvenli\u011fini, performans\u0131n\u0131 ve y\u00f6netilebilirli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r. Bu makalede, Nginx’i SSL (Secure Sockets Layer) ile Jenkins i\u00e7in bir ters proxy olarak nas\u0131l yap\u0131land\u0131raca\u011f\u0131m\u0131z\u0131 ad\u0131m ad\u0131m inceleyece\u011fiz. Bu sayede Jenkins kurulumunuz daha g\u00fcvenli, daha performansl\u0131 ve profesyonel bir yap\u0131ya kavu\u015facakt\u0131r.<\/p>\n
Jenkins’i Nginx arkas\u0131nda bir ters proxy olarak \u00e7al\u0131\u015ft\u0131rmak ve ileti\u015fimi SSL ile \u015fifrelemek, bir\u00e7ok \u00f6nemli avantaj sunar. Bu avantajlar, uygulaman\u0131z\u0131n g\u00fcvenli\u011fini, performans\u0131n\u0131 ve genel y\u00f6netimini iyile\u015ftirmeye yard\u0131mc\u0131 olur.<\/p>\n
Jenkins genellikle hassas kod depolar\u0131na eri\u015fim sa\u011flar ve da\u011f\u0131t\u0131m s\u00fcre\u00e7lerini y\u00f6netir. Bu nedenle g\u00fcvenli\u011fi son derece \u00f6nemlidir. SSL (HTTPS) kullanmak, istemci ile sunucu aras\u0131ndaki t\u00fcm ileti\u015fimi \u015fifreleyerek veri h\u0131rs\u0131zl\u0131\u011f\u0131n\u0131 ve kurcalamay\u0131 engeller. Nginx’i ters proxy olarak kullanmak ise Jenkins sunucusunu do\u011frudan internete a\u00e7maktan korur, potansiyel sald\u0131r\u0131 y\u00fczeyini azalt\u0131r. Nginx, g\u00fcvenlik duvar\u0131 gibi davranarak k\u00f6t\u00fc niyetli istekleri filtreleyebilir, DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 bir kalkan g\u00f6revi g\u00f6rebilir ve \u00e7e\u015fitli g\u00fcvenlik politikalar\u0131n\u0131 uygulayabilir.<\/p>\n
Nginx, statik i\u00e7eriklerin (CSS, JavaScript, resimler vb.) sunulmas\u0131nda olduk\u00e7a etkilidir. Jenkins’in dinamik i\u00e7eri\u011fi i\u015flerken, Nginx statik dosyalar\u0131 \u00f6nbelle\u011fe alarak ve do\u011frudan sunarak Jenkins sunucusunun y\u00fck\u00fcn\u00fc hafifletebilir. Bu, \u00f6zellikle y\u00fcksek trafikli ortamlarda Jenkins’in daha h\u0131zl\u0131 yan\u0131t vermesini sa\u011flar. Ayr\u0131ca, e\u011fer gelecekte Jenkins kurulumunuzu \u00f6l\u00e7eklendirmeniz gerekirse, Nginx birden fazla Jenkins \u00f6rne\u011fi aras\u0131nda y\u00fck dengelemesi yaparak trafi\u011fi da\u011f\u0131tabilir ve hizmetin s\u00fcrekli eri\u015filebilirli\u011fini sa\u011flayabilir.<\/p>\n
Nginx, farkl\u0131 portlarda veya farkl\u0131 sunucularda \u00e7al\u0131\u015fan birden fazla uygulamay\u0131 tek bir alan ad\u0131 veya IP adresi \u00fczerinden sunman\u0131za olanak tan\u0131r. \u00d6rne\u011fin, Nginx’in yap\u0131land\u0131rma dosyalar\u0131 olduk\u00e7a esnek ve okunabilirdir. SSL sertifikalar\u0131n\u0131n y\u00f6netimi, HTTP’den HTTPS’ye y\u00f6nlendirme, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131n eklenmesi gibi bir\u00e7ok yap\u0131land\u0131rma Nginx \u00fczerinde kolayca ger\u00e7ekle\u015ftirilebilir. Bu, Jenkins’in kendi i\u00e7 web sunucusunun (Jetty) do\u011frudan yap\u0131land\u0131rmas\u0131na g\u00f6re genellikle daha esnek ve g\u00fc\u00e7l\u00fc bir kontrol sa\u011flar.<\/p>\n Bu k\u0131lavuzu takip etmeden \u00f6nce a\u015fa\u011f\u0131daki \u00f6nko\u015fullar\u0131n yerine getirildi\u011finden emin olmal\u0131s\u0131n\u0131z:<\/p>\n Herhangi bir yaz\u0131l\u0131m kurulumuna ba\u015flamadan \u00f6nce sunucunuzun g\u00fcncel oldu\u011fundan ve gerekli temel paketlerin y\u00fckl\u00fc oldu\u011fundan emin olmak iyi bir uygulamad\u0131r.<\/p>\n Sunucunuzdaki paket listelerini g\u00fcncelleyin ve y\u00fckl\u00fc paketleri en son s\u00fcr\u00fcmlerine y\u00fckseltin:<\/p>\n Baz\u0131 temel ara\u00e7lar ve k\u00fct\u00fcphaneler i\u00e7in gerekli paketleri y\u00fckleyelim:<\/p>\n Jenkins’i kurmak i\u00e7in \u00f6ncelikle Java Development Kit’i (JDK) y\u00fcklememiz gerekmektedir, \u00e7\u00fcnk\u00fc Jenkins bir Java uygulamas\u0131d\u0131r.<\/p>\n Jenkins’in \u00e7o\u011fu s\u00fcr\u00fcm\u00fc OpenJDK 11 veya 17 ile uyumludur. Bu k\u0131lavuz i\u00e7in OpenJDK 17’yi kullanaca\u011f\u0131z:<\/p>\n Java s\u00fcr\u00fcm\u00fcn\u00fc kontrol ederek kurulumu do\u011frulay\u0131n:<\/p>\n Jenkins’in resmi deposunu sisteminize ekleyerek en g\u00fcncel s\u00fcr\u00fcm\u00fcn\u00fc y\u00fckleyebiliriz. \u0130lk olarak, Jenkins GPG anahtar\u0131n\u0131 i\u00e7e aktar\u0131n:<\/p>\n Ard\u0131ndan, Jenkins deposunu kaynak listenize ekleyin:<\/p>\n Depoyu ekledikten sonra, paket listesini tekrar g\u00fcncelleyin ve Jenkins’i kurun:<\/p>\n Kurulum tamamland\u0131ktan sonra Jenkins servisini ba\u015flat\u0131n ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak ba\u015flamas\u0131n\u0131 sa\u011flay\u0131n:<\/p>\n Jenkins’in durumunu kontrol ederek \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun:<\/p>\n Varsay\u0131lan olarak Jenkins 8080 portunda \u00e7al\u0131\u015f\u0131r. G\u00fcvenlik duvar\u0131n\u0131zda bu portun a\u00e7\u0131k oldu\u011fundan emin olun (sadece sunucu i\u00e7inden Nginx eri\u015fimi i\u00e7in, d\u0131\u015far\u0131ya de\u011fil):<\/p>\n Bu kural\u0131 daha sonra Nginx yap\u0131land\u0131rmas\u0131 tamamland\u0131\u011f\u0131nda sadece localhost’tan eri\u015fime izin verecek \u015fekilde daraltabiliriz.<\/p>\n Web taray\u0131c\u0131n\u0131zdan sunucunuzun IP adresi ve 8080 portu \u00fczerinden Jenkins’e eri\u015fin (\u00f6rne\u011fin, Bu \u015fifreyi kopyalay\u0131p Jenkins web aray\u00fcz\u00fcndeki ilgili alana yap\u0131\u015ft\u0131r\u0131n. Ard\u0131ndan, “Install suggested plugins” se\u00e7ene\u011fini se\u00e7erek \u00f6nerilen eklentileri y\u00fckleyin. Eklentiler y\u00fcklendikten sonra bir y\u00f6netici kullan\u0131c\u0131 olu\u015fturman\u0131z istenecektir. Gerekli bilgileri doldurun ve Jenkins kurulumunu tamamlay\u0131n.<\/p>\n Jenkins’in \u00f6n\u00fcne ge\u00e7ecek olan Nginx web sunucusunu \u015fimdi kurabiliriz.<\/p>\n Nginx’i Ubuntu depolar\u0131ndan y\u00fckleyebiliriz:<\/p>\n Kurulumdan sonra Nginx servisini ba\u015flat\u0131n ve sistem ba\u015flang\u0131c\u0131nda otomatik olarak ba\u015flamas\u0131n\u0131 sa\u011flay\u0131n:<\/p>\n Nginx’in durumunu kontrol edin:<\/p>\n Nginx’in HTTP (80) ve HTTPS (443) portlar\u0131ndan d\u0131\u015far\u0131dan eri\u015filebilir olmas\u0131 gerekmektedir. UFW (Uncomplicated Firewall) kullan\u0131yorsan\u0131z, Nginx i\u00e7in profilleri etkinle\u015ftirin:<\/p>\n \u015eu anda, Nginx’in varsay\u0131lan sayfas\u0131n\u0131 taray\u0131c\u0131n\u0131zdan sunucunuzun IP adresine giderek g\u00f6rmelisiniz. Bu, Nginx’in do\u011fru \u015fekilde \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/p>\n Web sitemizin g\u00fcvenli bir ba\u011flant\u0131 \u00fczerinden \u00e7al\u0131\u015fmas\u0131 i\u00e7in bir SSL sertifikas\u0131na ihtiyac\u0131m\u0131z var. Let’s Encrypt, \u00fccretsiz ve otomatik SSL sertifikalar\u0131 sa\u011flayan pop\u00fcler bir servistir. Certbot arac\u0131 ile bu sertifikalar\u0131 kolayca edinebiliriz.<\/p>\n Certbot’u Nginx eklentisi ile birlikte y\u00fckleyelim:<\/p>\n Certbot’u \u00e7al\u0131\u015ft\u0131rarak alan ad\u0131n\u0131z i\u00e7in SSL sertifikas\u0131 alabilirsiniz. Bu ad\u0131mda Certbot, Nginx yap\u0131land\u0131rman\u0131z\u0131 otomatik olarak alg\u0131layacak ve g\u00fcncelleyecektir. Hen\u00fcz Jenkins i\u00e7in bir Nginx yap\u0131land\u0131rma dosyas\u0131 olu\u015fturmad\u0131\u011f\u0131m\u0131z i\u00e7in, Certbot’un varsay\u0131lan Nginx yap\u0131land\u0131rmas\u0131n\u0131 kullanarak sertifika almas\u0131n\u0131 sa\u011flayaca\u011f\u0131z. Ard\u0131ndan, bu sertifikay\u0131 kendi Jenkins yap\u0131land\u0131rmam\u0131zda kullanaca\u011f\u0131z.<\/p>\n \u00d6ncelikle, Nginx’in varsay\u0131lan yap\u0131land\u0131rma dosyas\u0131nda ( Bu ge\u00e7ici ayar\u0131 yapt\u0131ktan sonra Nginx’i yeniden ba\u015flat\u0131n:<\/p>\n \u015eimdi Certbot’u \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n Let’s Encrypt sertifikalar\u0131 90 g\u00fcn ge\u00e7erlidir. Certbot, bu sertifikalar\u0131 otomatik olarak yenilemek i\u00e7in bir cron job veya systemd timer ayarlar. Yenileme i\u015flemini test edebilirsiniz:<\/p>\n Herhangi bir hata mesaj\u0131 almazsan\u0131z, otomatik yenileme d\u00fczg\u00fcn \u00e7al\u0131\u015f\u0131yor demektir.<\/p>\n \u015eimdi Nginx’i Jenkins i\u00e7in bir ters proxy olarak yap\u0131land\u0131rma zaman\u0131. Bu, gelen istekleri Nginx’in dinleyece\u011fi ve ard\u0131ndan bunlar\u0131 Jenkins sunucusuna iletece\u011fi anlam\u0131na gelir.<\/p>\n Yeni bir Nginx yap\u0131land\u0131rma dosyas\u0131 olu\u015ftural\u0131m. \u00d6rne\u011fin, Dosyan\u0131n i\u00e7eri\u011fi a\u015fa\u011f\u0131daki gibi olmal\u0131d\u0131r. Kendi alan ad\u0131n\u0131z\u0131 ( Yukar\u0131daki yap\u0131land\u0131rma, HTTP isteklerini otomatik olarak HTTPS’e y\u00f6nlendirir, SSL sertifikalar\u0131n\u0131 kullan\u0131r ve gelen t\u00fcm istekleri yerel Jenkins sunucusuna (8080 portu) iletir. Ayr\u0131ca, Jenkins’in WebSocket ba\u011flant\u0131lar\u0131 i\u00e7in gerekli olan Yeni yap\u0131land\u0131rma dosyas\u0131n\u0131 etkinle\u015ftirmek i\u00e7in bir sembolik ba\u011f (symlink) olu\u015ftural\u0131m ve Nginx’in varsay\u0131lan yap\u0131land\u0131rmas\u0131n\u0131 devre d\u0131\u015f\u0131 b\u0131rakal\u0131m:<\/p>\n Nginx yap\u0131land\u0131rmas\u0131n\u0131n s\u00f6zdizimini kontrol edin:<\/p>\n E\u011fer “test is successful” mesaj\u0131n\u0131 g\u00f6r\u00fcrseniz, Nginx servisini yeniden ba\u015flatarak de\u011fi\u015fiklikleri uygulay\u0131n:<\/p>\n Art\u0131k taray\u0131c\u0131n\u0131zdan Nginx ters proxy olarak ayarland\u0131ktan sonra, Jenkins’in de bu yeni eri\u015fim URL’sini bilmesi gerekir. Aksi takdirde, Jenkins web aray\u00fcz\u00fcnde baz\u0131 ba\u011flant\u0131lar hatal\u0131 g\u00f6r\u00fcnebilir veya y\u00f6nlendirmeler d\u00fczg\u00fcn \u00e7al\u0131\u015fmayabilir.<\/p>\n Jenkins web aray\u00fcz\u00fcne giri\u015f yap\u0131n ve sol men\u00fcden “Manage Jenkins”<\/strong> -> “System”<\/strong> yolunu izleyin.<\/p>\n A\u015fa\u011f\u0131 kayd\u0131rarak “Jenkins URL”<\/strong> veya “Jenkins Location”<\/strong> alan\u0131n\u0131 bulun. Bu alan\u0131 De\u011fi\u015fiklikleri kaydetmek i\u00e7in sayfan\u0131n alt\u0131ndaki “Save”<\/strong> veya “Apply”<\/strong> d\u00fc\u011fmesine t\u0131klay\u0131n.<\/p>\n Jenkins’in kendi i\u00e7 web sunucusunun (Jetty) sadece localhost \u00fczerinden eri\u015filebilir olmas\u0131n\u0131 sa\u011flamak, ek bir g\u00fcvenlik katman\u0131 sa\u011flar. Bu, do\u011frudan 8080 portuna eri\u015fimi k\u0131s\u0131tlayarak sadece Nginx’in Jenkins ile ileti\u015fim kurmas\u0131na izin verir.<\/p>\n Jenkins’in ba\u015flatma yap\u0131land\u0131rma dosyas\u0131n\u0131 d\u00fczenlemeniz gerekecektir. Ubuntu’da bu genellikle Bu dosya i\u00e7inde De\u011fi\u015fiklikleri kaydettikten sonra Jenkins servisini yeniden ba\u015flat\u0131n:<\/p>\n Bu de\u011fi\u015fiklikten sonra, Ayr\u0131ca, g\u00fcvenlik duvar\u0131n\u0131zda daha \u00f6nce a\u00e7t\u0131\u011f\u0131n\u0131z 8080 portu kural\u0131n\u0131 sadece localhost’tan eri\u015fime izin verecek \u015fekilde daraltmak isteyebilirsiniz:<\/p>\n Bu, sunucunun d\u0131\u015f\u0131ndan 8080 portuna eri\u015fimi tamamen kapat\u0131r ve sadece Nginx’in (sunucu i\u00e7inde \u00e7al\u0131\u015ft\u0131\u011f\u0131 i\u00e7in) Jenkins ile ileti\u015fim kurmas\u0131n\u0131 sa\u011flar.<\/p>\n Jenkins kurulumunuzu daha g\u00fcvenli ve performansl\u0131 hale getirmek i\u00e7in Nginx \u00fczerinde ek iyile\u015ftirmeler yapabiliriz.<\/p>\n HTTP\/2, web performans\u0131n\u0131 art\u0131rmak i\u00e7in tasarlanm\u0131\u015f yeni nesil bir protokold\u00fcr. Nginx yap\u0131land\u0131rmam\u0131zda zaten Nginx yap\u0131land\u0131rmas\u0131na ekleyebilece\u011finiz baz\u0131 g\u00fcvenlik ba\u015fl\u0131klar\u0131, web uygulaman\u0131z\u0131n \u00e7e\u015fitli sald\u0131r\u0131lara kar\u015f\u0131 direncini art\u0131r\u0131r. Bu ba\u015fl\u0131klar\u0131 Nginx Nginx, giden verileri s\u0131k\u0131\u015ft\u0131rarak bant geni\u015fli\u011fi kullan\u0131m\u0131n\u0131 azaltabilir ve y\u00fckleme s\u00fcrelerini h\u0131zland\u0131rabilir. Gzip s\u0131k\u0131\u015ft\u0131rmas\u0131n\u0131 etkinle\u015ftirmek i\u00e7in De\u011fi\u015fiklikleri kaydettikten sonra Nginx’i yeniden ba\u015flat\u0131n:<\/p>\n DDoS sald\u0131r\u0131lar\u0131na veya a\u015f\u0131r\u0131 istek g\u00f6ndermeye \u00e7al\u0131\u015fan k\u00f6t\u00fc niyetli kullan\u0131c\u0131lara kar\u015f\u0131 korunmak i\u00e7in Nginx \u00fczerinde h\u0131z s\u0131n\u0131rlamas\u0131 (rate limiting) uygulayabilirsiniz. Bu, Nginx’in Bu \u00f6rnek, her IP adresinden saniyede 10 iste\u011fe izin verir ve 20 iste\u011fe kadar k\u0131sa s\u00fcreli patlamalara izin verir. A\u015f\u0131r\u0131 istekler 503 hatas\u0131yla reddedilecektir. Kendi ihtiya\u00e7lar\u0131n\u0131za g\u00f6re bu de\u011ferleri ayarlamal\u0131s\u0131n\u0131z.<\/p>\n E\u011fer Jenkins’e eri\u015fimi daha da k\u0131s\u0131tlamak isterseniz, Nginx \u00fczerinde temel HTTP kimlik do\u011frulamas\u0131 (Basic Auth) ekleyebilirsiniz. Bu, Jenkins’in kendi kimlik do\u011frulamas\u0131ndan \u00f6nce bir katman daha ekler.<\/p>\n \u0130lk olarak, bir parola dosyas\u0131 olu\u015fturun:<\/p>\n \u015eifrenizi girmeniz istenecek. Ard\u0131ndan, Nginx yap\u0131land\u0131rma dosyan\u0131zdaki Nginx’i yeniden ba\u015flat\u0131n. Art\u0131k Jenkins’e eri\u015fmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131zda, \u00f6nce Nginx’in kimlik do\u011frulama penceresiyle kar\u015f\u0131la\u015facaks\u0131n\u0131z.<\/p>\n Kurulum veya yap\u0131land\u0131rma s\u0131ras\u0131nda kar\u015f\u0131la\u015fabilece\u011finiz yayg\u0131n sorunlar ve \u00e7\u00f6z\u00fcmleri a\u015fa\u011f\u0131dad\u0131r.<\/p>\n Sorun giderme s\u00fcrecinde en \u00f6nemli ara\u00e7lardan biri log dosyalar\u0131d\u0131r:<\/p>\n Bu dosyalar\u0131 Bu makalede, Nginx’i SSL ile Jenkins i\u00e7in bir ters proxy olarak nas\u0131l yap\u0131land\u0131raca\u011f\u0131m\u0131z\u0131 ayr\u0131nt\u0131l\u0131 bir \u015fekilde ele ald\u0131k. Ad\u0131m ad\u0131m sunucu haz\u0131rl\u0131\u011f\u0131ndan ba\u015flayarak, Jenkins ve Nginx kurulumlar\u0131n\u0131 ger\u00e7ekle\u015ftirdik, Let’s Encrypt ile \u00fccretsiz SSL sertifikas\u0131 edindik ve Nginx’i Jenkins’e gelen trafi\u011fi g\u00fcvenli bir \u015fekilde y\u00f6nlendirecek \u015fekilde yap\u0131land\u0131rd\u0131k. Ayr\u0131ca, Jenkins’in kendi i\u00e7 ayarlar\u0131n\u0131 g\u00fcncelleyerek ve Nginx \u00fczerinde ek g\u00fcvenlik ve performans iyile\u015ftirmeleri yaparak kurulumumuzu daha sa\u011flam hale getirdik.<\/p>\n Bu yap\u0131land\u0131rma ile Jenkins kurulumunuz art\u0131k:<\/p>\n Bu entegrasyon, CI\/CD s\u00fcre\u00e7lerinizin temelini olu\u015fturan Jenkins ortam\u0131n\u0131z\u0131n g\u00fcvenli\u011fini ve verimlili\u011fini art\u0131rmak i\u00e7in kritik bir ad\u0131md\u0131r. Uygulaman\u0131z\u0131n \u00f6l\u00e7eklenebilirli\u011fi ve s\u00fcrd\u00fcr\u00fclebilirli\u011fi a\u00e7\u0131s\u0131ndan da \u00f6nemli faydalar sa\u011flar.<\/p>\n Kurulumunuzu daha da geli\u015ftirmek i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 d\u00fc\u015f\u00fcnebilirsiniz:<\/p>\n Bu k\u0131lavuz, Jenkins ve Nginx ile g\u00fcvenli ve performansl\u0131 bir ters proxy kurulumu i\u00e7in sa\u011flam bir temel sa\u011flamaktad\u0131r. Kendi \u00f6zel ihtiya\u00e7lar\u0131n\u0131za ve g\u00fcvenlik gereksinimlerinize g\u00f6re yap\u0131land\u0131rmay\u0131 daha da \u00f6zelle\u015ftirebilirsiniz.<\/p>\n <\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx’i SSL ile Jenkins \u0130\u00e7in Ters Proxy Olarak Yap\u0131land\u0131rma\nGiri\u015f\nG\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen yaz\u0131l\u0131m geli\u015ftirme d\u00fcnyas\u0131nda, S\u00fcrekli","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1504],"tags":[],"class_list":{"0":"post-34539","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-nginx","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\njenkins.alanadiniz.com<\/code> adresinden Jenkins’e, blog.alanadiniz.com<\/code> adresinden bir bloga eri\u015febilirsiniz. Bu, kullan\u0131c\u0131lar i\u00e7in daha basit bir eri\u015fim noktas\u0131 sa\u011flar ve sunucu altyap\u0131n\u0131z\u0131n karma\u015f\u0131kl\u0131\u011f\u0131n\u0131 gizler.<\/p>\nKolay Y\u00f6netim<\/h3>\n
\u00d6nko\u015fullar<\/h2>\n
Sunucu Gereksinimleri<\/h3>\n
\n
Domain Ad\u0131<\/h3>\n
\n
jenkins.alanadiniz.com<\/code>). Bu alan ad\u0131n\u0131n DNS kay\u0131tlar\u0131n\u0131n sunucunuzun IP adresine i\u015faret etti\u011finden emin olun. A kayd\u0131 veya CNAME kayd\u0131 olu\u015fturman\u0131z gerekecektir.<\/li>\n<\/ul>\nPortlar<\/h3>\n
\n
\n
80<\/code> (HTTP – SSL sertifikas\u0131 edinmek ve otomatik y\u00f6nlendirme i\u00e7in)<\/li>\n443<\/code> (HTTPS – G\u00fcvenli Jenkins eri\u015fimi i\u00e7in)<\/li>\n8080<\/code> (Jenkins’in varsay\u0131lan \u00e7al\u0131\u015fma portu – sadece sunucu i\u00e7inde eri\u015filebilir olmal\u0131)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\nAd\u0131m 1: Sunucu Haz\u0131rl\u0131\u011f\u0131 ve G\u00fcncelleme<\/h2>\n
Sistem G\u00fcncellemesi<\/h3>\n
sudo apt update\nsudo apt upgrade -y\nsudo apt autoremove -y\n<\/code><\/pre>\nGerekli Paketlerin Kurulumu<\/h3>\n
sudo apt install -y curl wget gnupg2 apt-transport-https ca-certificates software-properties-common\n<\/code><\/pre>\nAd\u0131m 2: Jenkins Kurulumu<\/h2>\n
Java Kurulumu<\/h3>\n
sudo apt install -y openjdk-17-jdk\n<\/code><\/pre>\njava -version\n<\/code><\/pre>\nJenkins Deposu Ekleme<\/h3>\n
curl -fsSL https:\/\/pkg.jenkins.io\/debian-stable\/jenkins.io-2023.key | sudo tee \\\n \/usr\/share\/keyrings\/jenkins-keyring.asc > \/dev\/null\n<\/code><\/pre>\necho deb [signed-by=\/usr\/share\/keyrings\/jenkins-keyring.asc] \\\n https:\/\/pkg.jenkins.io\/debian-stable binary\/ | sudo tee \\\n \/etc\/apt\/sources.list.d\/jenkins.list > \/dev\/null\n<\/code><\/pre>\nJenkins Kurulumu ve Ba\u015flatma<\/h3>\n
sudo apt update\nsudo apt install -y jenkins\n<\/code><\/pre>\nsudo systemctl start jenkins\nsudo systemctl enable jenkins\n<\/code><\/pre>\nsudo systemctl status jenkins\n<\/code><\/pre>\nsudo ufw allow 8080\/tcp\n<\/code><\/pre>\nJenkins \u0130lk Kurulumu<\/h3>\n
http:\/\/sunucu_ip_adresiniz:8080<\/code>). Kar\u015f\u0131n\u0131za Jenkins’in kilidini a\u00e7man\u0131z gereken bir sayfa gelecektir. Y\u00f6netici \u015fifresini bulmak i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n:<\/p>\nsudo cat \/var\/lib\/jenkins\/secrets\/initialAdminPassword\n<\/code><\/pre>\nAd\u0131m 3: Nginx Kurulumu<\/h2>\n
Nginx Kurulumu<\/h3>\n
sudo apt install -y nginx\n<\/code><\/pre>\nNginx Servisini Ba\u015flatma ve Etkinle\u015ftirme<\/h3>\n
sudo systemctl start nginx\nsudo systemctl enable nginx\n<\/code><\/pre>\nsudo systemctl status nginx\n<\/code><\/pre>\nG\u00fcvenlik Duvar\u0131 Ayarlar\u0131<\/h3>\n
sudo ufw allow 'Nginx HTTP'\nsudo ufw allow 'Nginx HTTPS'\nsudo ufw reload\n<\/code><\/pre>\nAd\u0131m 4: SSL Sertifikas\u0131 Edinme (Let’s Encrypt ile)<\/h2>\n
Certbot Kurulumu<\/h3>\n
sudo apt install -y certbot python3-certbot-nginx\n<\/code><\/pre>\nSSL Sertifikas\u0131 Alma<\/h3>\n
\/etc\/nginx\/sites-available\/default<\/code>) sunucu ad\u0131n\u0131z\u0131n (server_name) do\u011fru \u015fekilde ayarland\u0131\u011f\u0131ndan emin olun. E\u011fer ayarl\u0131 de\u011filse, ge\u00e7ici olarak ekleyin:<\/p>\n# \/etc\/nginx\/sites-available\/default dosyas\u0131n\u0131 a\u00e7\u0131n ve server_name sat\u0131r\u0131n\u0131 bulun\nE\u011fer yoksa, server blo\u011funun i\u00e7ine ekleyin:<\/h2>\n
server_name jenkins.alanadiniz.com;<\/h2>\n<\/code><\/pre>\n
sudo systemctl restart nginx\n<\/code><\/pre>\nsudo certbot --nginx -d jenkins.alanadiniz.com\n<\/code><\/pre>\njenkins.alanadiniz.com<\/code> k\u0131sm\u0131n\u0131 kendi alan ad\u0131n\u0131zla de\u011fi\u015ftirin. Certbot size e-posta adresi, hizmet \u015fartlar\u0131n\u0131 kabul etme ve HTTP trafi\u011fini HTTPS’e y\u00f6nlendirme gibi birka\u00e7 soru soracakt\u0131r. HTTP trafi\u011fini HTTPS’e y\u00f6nlendirme se\u00e7ene\u011fini (genellikle 2) se\u00e7meniz \u00f6nerilir. Ba\u015far\u0131l\u0131 bir kurulumdan sonra sertifikalar\u0131n\u0131z \/etc\/letsencrypt\/live\/jenkins.alanadiniz.com\/<\/code> dizininde bulunacakt\u0131r.<\/p>\nOtomatik Yenileme<\/h3>\n
sudo certbot renew --dry-run\n<\/code><\/pre>\nAd\u0131m 5: Nginx’i Ters Proxy Olarak Yap\u0131land\u0131rma<\/h2>\n
Nginx Yap\u0131land\u0131rma Dosyas\u0131 Olu\u015fturma<\/h3>\n
\/etc\/nginx\/sites-available\/jenkins<\/code>:<\/p>\nsudo nano \/etc\/nginx\/sites-available\/jenkins\n<\/code><\/pre>\njenkins.alanadiniz.com<\/code>) ve SSL sertifikas\u0131 yollar\u0131n\u0131 (Certbot’un olu\u015fturdu\u011fu) g\u00fcncellemeyi unutmay\u0131n.<\/p>\nserver {\n listen 80;\n listen [::]:80;\n server_name jenkins.alanadiniz.com;\n\n # HTTP'den HTTPS'ye y\u00f6nlendirme\n return 301 https:\/\/$host$request_uri;\n}\n\nserver {\n listen 443 ssl http2;\n listen [::]:443 ssl http2;\n server_name jenkins.alanadiniz.com;\n\n ssl_certificate \/etc\/letsencrypt\/live\/jenkins.alanadiniz.com\/fullchain.pem;\n ssl_certificate_key \/etc\/letsencrypt\/live\/jenkins.alanadiniz.com\/privkey.pem;\n ssl_session_cache shared:SSL:10m;\n ssl_session_timeout 1h;\n ssl_protocols TLSv1.2 TLSv1.3;\n ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';\n ssl_prefer_server_ciphers on;\n ssl_stapling on;\n ssl_stapling_verify on;\n add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n add_header X-Frame-Options DENY;\n add_header X-Content-Type-Options nosniff;\n add_header X-XSS-Protection \"1; mode=block\";\n add_header Referrer-Policy \"no-referrer-when-downgrade\";\n\n # Proxy ayarlar\u0131\n location \/ {\n proxy_pass http:\/\/127.0.0.1:8080;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n proxy_set_header X-Forwarded-Host $host;\n proxy_set_header X-Nginx-Proxy true;\n proxy_redirect http:\/\/ https:\/\/;\n\n # Jenkins'in WebSocket ba\u011flant\u0131lar\u0131 i\u00e7in gerekli ayarlar\n proxy_http_version 1.1;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"upgrade\";\n proxy_read_timeout 90s;\n\n # \u00d6nbellekleme ayarlar\u0131 (iste\u011fe ba\u011fl\u0131, statik i\u00e7erikler i\u00e7in)\n # expires 1d;\n # add_header Cache-Control \"public, no-transform\";\n }\n}\n<\/code><\/pre>\nUpgrade<\/code> ve Connection<\/code> ba\u015fl\u0131klar\u0131n\u0131 da i\u00e7erir. G\u00fcvenlik i\u00e7in baz\u0131 HTTP ba\u015fl\u0131klar\u0131 da eklenmi\u015ftir.<\/p>\nYap\u0131land\u0131rmay\u0131 Test Etme ve Uygulama<\/h3>\n
sudo ln -s \/etc\/nginx\/sites-available\/jenkins \/etc\/nginx\/sites-enabled\/\nsudo rm \/etc\/nginx\/sites-enabled\/default\n<\/code><\/pre>\nsudo nginx -t\n<\/code><\/pre>\nsudo systemctl restart nginx\n<\/code><\/pre>\nhttps:\/\/jenkins.alanadiniz.com<\/code> adresine giderek Jenkins’e g\u00fcvenli bir \u015fekilde eri\u015febilmelisiniz.<\/p>\nAd\u0131m 6: Jenkins Yap\u0131land\u0131rmas\u0131<\/h2>\n
Jenkins Sistem Ayarlar\u0131<\/h3>\n
https:\/\/jenkins.alanadiniz.com<\/code> olarak g\u00fcncelleyin. Bu ayar, Jenkins’in kendine ait URL’leri do\u011fru bir \u015fekilde olu\u015fturmas\u0131n\u0131 sa\u011flar.<\/p>\nG\u00fcvenlik Ayarlar\u0131<\/h3>\n
\/etc\/default\/jenkins<\/code> veya \/etc\/sysconfig\/jenkins<\/code> (Red Hat tabanl\u0131 sistemler i\u00e7in) dosyas\u0131ndad\u0131r.<\/p>\nsudo nano \/etc\/default\/jenkins\n<\/code><\/pre>\nJENKINS_ARGS<\/code> sat\u0131r\u0131n\u0131 bulun ve --httpListenAddress=127.0.0.1<\/code> parametresini ekleyin veya mevcut parametreleri g\u00fcncelleyin:<\/p>\n# \u00d6rnek:\nJENKINS_ARGS=\"--webroot=\/var\/cache\/jenkins\/war --httpPort=8080\"<\/h2>\n
\u015euna d\u00f6n\u00fc\u015ft\u00fcr\u00fcn:<\/h2>\nJENKINS_ARGS=\"--webroot=\/var\/cache\/jenkins\/war --httpPort=8080 --httpListenAddress=127.0.0.1\"\n<\/code><\/pre>\n
sudo systemctl restart jenkins\n<\/code><\/pre>\nhttp:\/\/sunucu_ip_adresiniz:8080<\/code> adresinden Jenkins’e do\u011frudan eri\u015fmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131zda eri\u015fimin engellendi\u011fini g\u00f6rmelisiniz. Art\u0131k Jenkins’e sadece Nginx \u00fczerinden, yani https:\/\/jenkins.alanadiniz.com<\/code> adresinden eri\u015filebilir.<\/p>\nsudo ufw delete allow 8080\/tcp # Mevcut kural\u0131 sil\nsudo ufw allow in on lo to any port 8080 # Sadece localhost'tan 8080'e izin ver\nsudo ufw reload\n<\/code><\/pre>\nAd\u0131m 7: G\u00fcvenlik \u0130yile\u015ftirmeleri ve Ek Yap\u0131land\u0131rmalar<\/h2>\n
HTTP\/2 Etkinle\u015ftirme<\/h3>\n
http2<\/code> anahtar kelimesini eklemi\u015ftik (listen 443 ssl http2;<\/code>). Bu, HTTP\/2’nin otomatik olarak etkinle\u015ftirildi\u011fi anlam\u0131na gelir. Taray\u0131c\u0131n\u0131z\u0131n geli\u015ftirici ara\u00e7lar\u0131ndan veya \u00e7evrimi\u00e7i ara\u00e7larla sitenizin HTTP\/2 \u00fczerinden sunulup sunulmad\u0131\u011f\u0131n\u0131 kontrol edebilirsiniz.<\/p>\nG\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme<\/h3>\n
server<\/code> blo\u011funuzdaki location \/<\/code> blo\u011funun d\u0131\u015f\u0131na ekleyebilirsiniz (zaten baz\u0131lar\u0131n\u0131 eklemi\u015ftik, \u015fimdi daha fazlas\u0131n\u0131 ekleyelim veya mevcutlar\u0131 g\u00f6zden ge\u00e7irelim):<\/p>\nserver {\n # ... di\u011fer ayarlar ...\n\n add_header X-Frame-Options \"DENY\";\n add_header X-Content-Type-Options \"nosniff\";\n add_header X-XSS-Protection \"1; mode=block\";\n add_header Referrer-Policy \"no-referrer-when-downgrade\";\n add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n \n # Content Security Policy (CSP) - Dikkatli kullan\u0131lmal\u0131, uygulaman\u0131z\u0131n ihtiya\u00e7lar\u0131na g\u00f6re ayarlanmal\u0131\n # add_header Content-Security-Policy \"default-src 'self' jenkins.alanadiniz.com; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';\";\n\n location \/ {\n # ... proxy ayarlar\u0131 ...\n }\n}\n<\/code><\/pre>\n\n
X-Frame-Options \"DENY\"<\/code>: Clickjacking sald\u0131r\u0131lar\u0131n\u0131 \u00f6nler.<\/li>\nX-Content-Type-Options \"nosniff\"<\/code>: Taray\u0131c\u0131lar\u0131n MIME t\u00fcrlerini tahmin etmesini engeller, potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 azalt\u0131r.<\/li>\nX-XSS-Protection \"1; mode=block\"<\/code>: Taray\u0131c\u0131lar\u0131n XSS sald\u0131r\u0131lar\u0131n\u0131 alg\u0131lamas\u0131na ve engellemesine yard\u0131mc\u0131 olur.<\/li>\nReferrer-Policy \"no-referrer-when-downgrade\"<\/code>: Y\u00f6nlendiren bilgilerinin g\u00fcvenli olmayan ba\u011flant\u0131larda g\u00f6nderilmesini engeller.<\/li>\nStrict-Transport-Security \"max-age=31536000; includeSubDomains\" always;<\/code> (HSTS): Taray\u0131c\u0131lara sitenize her zaman HTTPS \u00fczerinden ba\u011flanmalar\u0131n\u0131 s\u00f6yler, man-in-the-middle sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar.<\/li>\nContent-Security-Policy (CSP)<\/code>: Bu ba\u015fl\u0131k olduk\u00e7a g\u00fc\u00e7l\u00fcd\u00fcr ancak yanl\u0131\u015f yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda uygulaman\u0131z\u0131 bozabilir. Hangi kaynaklardan komut dosyas\u0131, stil, resim vb. y\u00fckleyebilece\u011finizi tan\u0131mlar. Jenkins’in kulland\u0131\u011f\u0131 t\u00fcm kaynaklar\u0131 do\u011fru bir \u015fekilde listelemeniz gerekir. Bu ba\u015fl\u0131\u011f\u0131 eklemeden \u00f6nce dikkatlice test etmeniz \u00f6nerilir.<\/li>\n<\/ul>\nS\u0131k\u0131\u015ft\u0131rma (Gzip)<\/h3>\n
nginx.conf<\/code> dosyas\u0131n\u0131 (genellikle \/etc\/nginx\/nginx.conf<\/code>) d\u00fczenleyin:<\/p>\nsudo nano \/etc\/nginx\/nginx.conf\n<\/code><\/pre>\nhttp { ... }<\/code> blo\u011funun i\u00e7ine a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin veya mevcut olanlar\u0131 g\u00fcncelleyin:<\/p>\nhttp {\n # ... di\u011fer http ayarlar\u0131 ...\n\n gzip on;\n gzip_vary on;\n gzip_proxied any;\n gzip_comp_level 6;\n gzip_buffers 16 8k;\n gzip_http_version 1.1;\n gzip_types text\/plain text\/css application\/json application\/javascript text\/xml application\/xml application\/xml+rss text\/javascript;\n}\n<\/code><\/pre>\nsudo systemctl restart nginx\n<\/code><\/pre>\nRate Limiting<\/h3>\n
http<\/code> blo\u011funa eklenir:<\/p>\nhttp {\n # ... di\u011fer http ayarlar\u0131 ...\n\n limit_req_zone $binary_remote_addr zone=jenkins_limit:10m rate=10r\/s; # 10MB bellek, IP ba\u015f\u0131na saniyede 10 istek\n\n server {\n # ... di\u011fer server ayarlar\u0131 ...\n\n location \/ {\n limit_req zone=jenkins_limit burst=20 nodelay; # 20 isteklik bir patlamaya izin ver, gecikme yok\n # ... proxy ayarlar\u0131 ...\n }\n }\n}\n<\/code><\/pre>\nKullan\u0131c\u0131 Kimlik Do\u011frulama (Nginx taraf\u0131nda)<\/h3>\n
sudo apt install -y apache2-utils # htpasswd arac\u0131n\u0131 y\u00fcklemek i\u00e7in\nsudo htpasswd -c \/etc\/nginx\/.htpasswd jenkinsadmin # jenkinsadmin yerine istedi\u011finiz kullan\u0131c\u0131 ad\u0131n\u0131 yaz\u0131n\n<\/code><\/pre>\nlocation \/<\/code> blo\u011funa a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin:<\/p>\nlocation \/ {\n auth_basic \"Restricted Access\";\n auth_basic_user_file \/etc\/nginx\/.htpasswd;\n # ... di\u011fer proxy ayarlar\u0131 ...\n}\n<\/code><\/pre>\nSorun Giderme<\/h2>\n
Nginx Hatalar\u0131<\/h3>\n
\n
\n
sudo nginx -t<\/code> komutunu \u00e7al\u0131\u015ft\u0131rarak yap\u0131land\u0131rma dosyan\u0131zdaki s\u00f6zdizimi hatalar\u0131n\u0131 kontrol edin.<\/li>\nsudo systemctl status nginx<\/code> komutuyla Nginx servisinin durumunu kontrol edin ve hata mesajlar\u0131n\u0131 inceleyin.<\/li>\n\/var\/log\/nginx\/error.log<\/code>.<\/li>\n<\/ul>\n<\/li>\n\n
sudo systemctl status jenkins<\/code>.<\/li>\nsudo ss -tulpn | grep 8080<\/code>.<\/li>\nproxy_pass http:\/\/127.0.0.1:8080;<\/code> adresinin do\u011fru oldu\u011fundan emin olun.<\/li>\nJenkins Hatalar\u0131<\/h3>\n
\n
\n
https:\/\/jenkins.alanadiniz.com<\/code> olarak do\u011fru ayarland\u0131\u011f\u0131ndan emin olun.<\/li>\nproxy_redirect http:\/\/ https:\/\/;<\/code> sat\u0131r\u0131n\u0131n mevcut oldu\u011fundan emin olun.<\/li>\n<\/ul>\n<\/li>\n\n
\/etc\/default\/jenkins<\/code> dosyas\u0131ndaki JENKINS_ARGS<\/code> i\u00e7inde --httpListenAddress=127.0.0.1<\/code> parametresinin do\u011fru \u015fekilde eklendi\u011finden ve Jenkins servisinin yeniden ba\u015flat\u0131ld\u0131\u011f\u0131ndan emin olun.<\/li>\nSSL Hatalar\u0131<\/h3>\n
\n
\n
ssl_certificate<\/code> ve ssl_certificate_key<\/code> yollar\u0131n\u0131n do\u011fru oldu\u011fundan emin olun.<\/li>\nsudo certbot renew --dry-run<\/code> komutuyla sertifikan\u0131n hala ge\u00e7erli oldu\u011funu kontrol edin.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\nLog Dosyalar\u0131n\u0131 Kontrol Etme<\/h3>\n
\n
\/var\/log\/nginx\/access.log<\/code><\/li>\n\/var\/log\/nginx\/error.log<\/code><\/li>\n\/var\/log\/jenkins\/jenkins.log<\/code><\/li>\n<\/ul>\ntail -f<\/code> komutuyla canl\u0131 olarak izleyerek sorunlar\u0131 daha h\u0131zl\u0131 tespit edebilirsiniz.<\/p>\nSonu\u00e7<\/h2>\n
\u00d6zet<\/h3>\n
\n
Gelecek Ad\u0131mlar<\/h3>\n
\n