nordstromsets/jira repository overview

⁠Atlassian Jira

A containerized installation of Atlassian Jira.

⁠Provision a Host

Jira runs on port 8443, 8090, and 8091.

The port 8443 connector will serve your certificate over SSL.

The port 8090 connector serves http and includes proxy params in the http headers so the container can be run behind a load balancer that terminates SSL.

The port 8091 connector serves http (for use with load balancer health checks, instance boot-up, and for troubleshooting)

Typical launch map host ports 443, 80, and 81 and mounts the Jira home directory to a host dir as:

sudo docker run --name jira \
-v /myhome/jira:/var/local/atlassian/jira:rw \
-v /etc/localtime:/etc/localtime:ro \
-p 443:8443 \
-p 80:8080 \
-p 81:8081 \
-t nordstromsets/jira:latest

⁠HTTPS

The container assumes a certificate in pkcs12 format, and assumes the certificate lives at: /var/local/atlassian/jira/jira_keystore.pkcs12

Overwrite the cert using a volume mount, e.g.:

sudo docker run --name jira \
-v /myhome/jira:/var/local/atlassian/jira:rw \
-v /mycerts/jira.pkcs12:/var/local/atlassian/jira/jira_keystore.pkcs12:ro \
-v /etc/localtime:/etc/localtime:ro \
...

⁠HTTP-to-HTTPS rewrites

In intranet environments it is possible to browse to Jira with just the Jira cname. For example, if the cname 'jira' aliases jira.nordstrom.net, a user can put 'jira' in their browser and be taken to Jira.

After arriving it is desirable for the user to be redirected to HTTPS before they login (to ensure their credentials are encrpyted).

When the arrive under HTTPS, they should arrive to a URL that matches one of the SANs (subject alternative names) associated with the cert served by Jira (to ensure they don't get a browse security warning).

The container will perform this redirect IFF you provide the FQDN of your site via an ENV. Your users will arrive with no browser security warning IFF the FQDN matches one of the cert SANs.

For example:

sudo docker run --name jira \
-e FQDN=jira.nordstrom.net
...

⁠JVM Opts

⁠Performance

Performance tuning is achieved primarily though the CATALINA_OPTS environment variable.

The following setpoint is appropriate for a large instance with 2-3K users, and should be paired with an VM with 32GB of RAM and at least 8 vCPU cores.

Running the CMS GC is contrary to Atlassian G1GC recommendation, but we have found that G1GC does a poor job handling 16GB of heap and that CMS is more reliable.

docker run -d \
-e CATALINA_OPTS="-Xms16G -Xmx16G -XX:+UseConcMarkSweepGC -Datlassian.plugins.enable.wait=600 -Dfile.encoding=UTF-8 -verbose:gc" \
...

⁠Outbound Proxy

In order for Jira to navigate an outbound proxy, proxy configs must be added to CATALIN_OPTS, e.g.:

-Dhttp.proxySet=true \
-Dhttp.proxyHost=pbcld-proxy.nordstrom.net \
-Dhttp.proxyPort=3128 \
-Dhttps.proxyHost=pbcld-proxy.nordstrom.net \
-Dhttps.proxyPort=3128 \
-Dhttp.nonProxyHosts='localhost|10.0.0/8|*.nordstrom.net' \
-Dhttps.nonProxyHosts='localhost|10.0.0/8|*.nordstrom.net'

The non-proxy hosts are critical if you also want to integrate Jira with other BTFW apps (like Confluence and Bitbucket Server). (Note that you must add a *. prefex to all domains per the example above)

Combining this with the performance-related settings looks like:

docker run -d \
-e CATALINA_OPTS="-Xms16G -Xmx16G -XX:+UseConcMarkSweepGC -Datlassian.plugins.enable.wait=600 -Dfile.encoding=UTF-8 -verbose:gc -Dhttp.proxySet=true -Dhttp.proxyHost=pbcld-proxy.nordstrom.net -Dhttp.proxyPort=3128 -Dhttps.proxyHost=pbcld-proxy.nordstrom.net -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts='localhost|10.0.0/8|*.nordstrom.net' -Dhttps.nonProxyHosts='localhost|10.0.0/8|*.nordstrom.net'" \
...

⁠Use Cases

⁠OS Patches

Dockerfile includes apt-get update, so simply rebuild container image.

⁠Jira Upgrade

Roll JIRA_VERSION ENV in Dockerfile and rebuild container image.

⁠Backups

A volume is provided for the home directory, which includes the dbconfig.xml file, and index, and data directories.

All should be backed up in order to recover a lost server.

⁠Log Aggregation

Volumes are provided for catalina logs (<JIRA_INSTALL>/log/* ) and home directories.

Log files from both can be forwarded for log aggregation.

⁠File Cleanup

A cron job is included that will auto-remove log and export files that are more than EXPIRATION_AGE old (in days)

For example, to expire log and export files older than 30 days, use docker run as ...

docker run -d -e EXPIRATION_AGE=30 ...