Jenkins Controller Setup

Install, harden, and configure a Jenkins LTS controller on Ubuntu 24.04 for a private-network CI environment.

Target state

Installation

# Update and install OpenJDK 17
sudo apt update
sudo apt install -y fontconfig openjdk-17-jre-headless

# Verify
java -version
# openjdk version "17.0.x" ...

# Add the Jenkins signing key
sudo wget -O /usr/share/keyrings/jenkins-keyring.asc \
  https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key

# Add the LTS repository
echo "deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc]" \
     "https://pkg.jenkins.io/debian-stable binary/" \
  | sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/null

sudo apt update
sudo apt install -y jenkins

# Start and enable at boot
sudo systemctl enable --now jenkins
sudo systemctl status jenkins --no-pager

# Initial admin password
sudo cat /var/lib/jenkins/secrets/initialAdminPassword

Plugin set

The minimum needed for the pipeline in this series. Install via Manage Jenkins → Plugins → Available.

Hardening

Set executors on the controller to 0

By default Jenkins runs builds on the controller itself. That means build scripts execute with access to /var/lib/jenkins — including credentials.xml and the master key. Any pipeline can then read every secret Jenkins holds.

Manage Jenkins → Nodes → Built-In Node → Configure → Number of executors → 0

Security realm and authorization

Manage Jenkins → Security

• Security Realm — Jenkins' own user database. Uncheck Allow users to sign up.
• Authorization — Matrix-based security, or Role-Based Strategy plugin if you need per-folder roles. Never leave it on Anyone can do anything.
• CSRF Protection — enabled (default). Leave it on.
• Agent → Controller Access Control — enabled.
• CLI over Remoting — disabled.

Nginx reverse proxy with TLS

# /etc/nginx/sites-available/jenkins
upstream jenkins { server 127.0.0.1:8080 fail_timeout=0; }

server {
  listen 443 ssl http2;
  server_name jenkins.example.internal;

  ssl_certificate     /etc/ssl/certs/jenkins.crt;
  ssl_certificate_key /etc/ssl/private/jenkins.key;
  ssl_protocols TLSv1.2 TLSv1.3;

  add_header X-Content-Type-Options nosniff always;
  add_header X-Frame-Options SAMEORIGIN always;

  location / {
    proxy_pass         http://jenkins;
    proxy_set_header   Host              $host;
    proxy_set_header   X-Real-IP         $remote_addr;
    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_redirect     http:// https://;

    # Required for the Jenkins UI's live console streaming
    proxy_http_version 1.1;
    proxy_set_header   Upgrade    $http_upgrade;
    proxy_set_header   Connection $connection_upgrade;

    proxy_buffering off;
    proxy_request_buffering off;
  }
}

# /etc/nginx/nginx.conf — inside the http{} block
map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

Then bind Jenkins to localhost only, so the proxy is the only path in:

# /etc/default/jenkins  (or systemd override on newer packages)
JENKINS_LISTEN_ADDRESS=127.0.0.1

# Tell Jenkins its external URL
# Manage Jenkins → System → Jenkins Location → Jenkins URL
#   https://jenkins.example.internal/

Firewall

sudo ufw allow from 10.10.0.0/16 to any port 443 proto tcp
sudo ufw deny 8080
sudo ufw enable
sudo ufw status verbose

Global tool configuration

Manage Jenkins → Tools → NodeJS installations → Add NodeJS

Add one entry per Node version your projects actually run. The Name is what the Jenkinsfile references in its tools block, so keep it predictable:

Build retention

Set on every job (or in the Jenkinsfile options block, covered in Part 4):

options {
  buildDiscarder(logRotator(numToKeepStr: '30'))
  disableConcurrentBuilds()
  timestamps()
}

• buildDiscarder — 30 builds is enough history to bisect a regression without filling the disk with archived artifacts and console logs.
• disableConcurrentBuilds — essential when the pipeline deploys. Two simultaneous builds racing to git reset --hard and pm2 restart the same directory will corrupt the deployment.
• timestamps — every console line gets a timestamp. Free, and makes "which stage is slow" answerable.

Verification checklist