配置代理服务器

在代理服务器后面设置 TeamCity 服务器

代理应该考虑到通用网络安全进行配置。像 引用来源 和 来源 这样的头部，以及所有未知的头部，都应以未修改的形式传递给 TeamCity 网络应用程序。例如，TeamCity 依赖客户端添加的 X-TC-CSRF-Token 头。

Apache

LoadModule  proxy_module          /usr/lib/apache2/modules/mod_proxy.so
LoadModule  proxy_http_module     /usr/lib/apache2/modules/mod_proxy_http.so
LoadModule  headers_module        /usr/lib/apache2/modules/mod_headers.so
LoadModule  proxy_wstunnel_module /usr/lib/apache2/modules/mod_proxy_wstunnel.so

ProxyRequests       Off
ProxyPreserveHost   On
ProxyPass           /tc/app/subscriptions ws://teamcity.local:8111/tc/app/subscriptions connectiontimeout=240 timeout=1200
ProxyPassReverse    /tc/app/subscriptions ws://teamcity.local:8111/tc/app/subscriptions

ProxyPass           /tc http://teamcity.local:8111/tc connectiontimeout=240 timeout=1200
ProxyPassReverse    /tc http://teamcity.local:8111/tc

## The following entries are required to allow the Agent Terminal feature to function with websockets
ProxyPass           /tc/plugins/teamcity-agent-terminal/ ws://teamcity.local:8111/tc/plugins/teamcity-agent-terminal/ connectiontimeout=240 timeout=1200
ProxyPassReverse    /tc/plugins/teamcity-agent-terminal/ ws://teamcity.local:8111/tc/plugins/teamcity-agent-terminal/

ProxyPass           /tc/app/agentTerminal/ ws://teamcity.local:8111/tc/app/agentTerminal/ connectiontimeout=240 timeout=1200
ProxyPassReverse    /tc/app/agentTerminal/ ws://teamcity.local:8111/tc/app/agentTerminal/

<IfModule mpm_worker_module>
    ServerLimit 100
    StartServers 3
    MinSpareThreads 25
    MaxSpareThreads 75
    ThreadLimit 64
    ThreadsPerChild 25
    MaxClients 2500
    MaxRequestsPerChild 0
</IfModule>

NGINX

http {
    ... default settings here
    proxy_read_timeout      1200;
    proxy_connect_timeout   240;
    client_max_body_size    0; # maximum size of an HTTP request. 0 allows uploading large artifacts to TeamCity

    map $http_upgrade $connection_upgrade { # WebSocket support
        default upgrade;
        '' '';
    }

    server {
        listen      400; # public server port
        server_name teamcity.public; # public server host name

        location / { # public context (should be the same as internal context)
            proxy_pass          http://teamcity.local:8111; # full internal address
            proxy_http_version  1.1;
            proxy_set_header    Host $server_name:$server_port;
            proxy_set_header    X-Forwarded-Host $http_host; # necessary for proper absolute redirects and TeamCity CSRF check
            proxy_set_header    X-Forwarded-Proto $scheme;
            proxy_set_header    X-Forwarded-For $remote_addr;
            proxy_set_header    Upgrade $http_upgrade; # WebSocket support
            proxy_set_header    Connection $connection_upgrade; # WebSocket support
        }
    }
}

IIS

为您的 TeamCity 服务器创建一个规范名称（CNAME）记录。
发行一个证书，以确保 TeamCity 服务器与外部用户之间的安全连接。如果证书不是由知名证书颁发机构颁发的，您可能需要在每台连接到 TeamCity 的机器上手动将其添加到 Java 证书存储中：
```
keytool -importcert -file <cert file> -keystore <path to JRE installation>/lib/security/cacerts
```
将 server URL 更改为代理 URL。
编辑 <TeamCity 安装目录>/conf/server.xml 文件，按照 TeamCity Tomcat 配置小节中的描述来设置所需的 TeamCity Tomcat 服务器属性。

步骤5到8在Powershell中执行。使用 Get-IISConfigSection 和 Set-IISConfigAttributeValue 命令来启动 SSL 标志：

$ConfigSectionTC = Get-IISConfigSection -SectionPath "system.webServer/security/access" -Location "<IIS Website name>";
Set-IISConfigAttributeValue -AttributeName sslFlags -AttributeValue Ssl -ConfigElement $ConfigSectionTC;

使用 Set-WebConfigurationProperty cmdlet 添加一个服务器变量，允许从web请求中传递HTTP转发的IP：

Set-WebConfigurationProperty -pspath "IIS:/" -Location "<IIS Website name>" -filter "system.webServer/rewrite/allowedServerVariables" -name "." -value @{name="HTTP_FORWARDED"} -FORCE

启用代理设置：

Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST" -filter "system.webServer/proxy" -name "." -value @{   enabled="true" } -FORCE

如果您使用外部存储来保存 TeamCity 的工件，请禁用 reverseRewriteHostInResponseHeaders 参数：

Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST" -filter "system.webServer/proxy" -name "." -value @{   reverseRewriteHostInResponseHeaders="false" } -FORCE

按照以下方式修改 IIS web.config 文件：

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.web>
        <httpRuntime requestPathInvalidCharacters="" />
    </system.web>
    <system.webServer>
        <rewrite>
            <rules useOriginalURLEncoding="true">
                <rule name="teamcity" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*" />
                    <action type="Rewrite" url="http://localhost:80/{R:0}" />
                    <serverVariables>
                        <set name="HTTP_FORWARDED" value="for={REMOTE_ADDR};by={LOCAL_ADDR};host=&quot;{HTTP_HOST}&quot;;proto=&quot;https&quot;" />
                    </serverVariables>
                </rule>
            </rules>
        </rewrite>
        <security>
            <requestFiltering allowDoubleEscaping="true">
                <fileExtensions>
                    <remove fileExtension=".config" />
                </fileExtensions>
                <hiddenSegments>
                    <remove segment="bin" />
                </hiddenSegments>
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>

TeamCity Tomcat 配置

您需要更改 <TeamCity Home>/conf/server.xml 文件中的 "Connector" 节点，如下所示。

<Connector port="8111" protocol="org.apache.coyote.http11.Http11NioProtocol"
    connectionTimeout="60000"
    useBodyEncodingForURI="true"
    socket.txBufSize="64000"
    socket.rxBufSize="64000"
    tcpNoDelay="1"
    secure="false"
    scheme="http"
/>

当公共服务器地址为 HTTPS 时，请使用 secure="true" 和 scheme="https" 属性。如果缺少这些属性，TeamCity 将会显示相应的健康报告。

<Connector port="80" protocol="org.apache.coyote.http11.Http11NioProtocol"
  connectionTimeout="60000"
  redirectPort="8543"
  useBodyEncodingForURI="true"
  socket.txBufSize="64000"
  socket.rxBufSize="64000"
  tcpNoDelay="1"
  proxyName="<your_CNAME_value>"
  proxyPort="443"
  secure="true"
  scheme="https"
/>

<Valve
  className="org.apache.catalina.valves.RemoteIpValve"
  remoteIpHeader="x-forwarded-for"
  protocolHeader="x-forwarded-proto"
  portHeader="x-forwarded-port"
  internalProxies="<internal_proxy_ip>"
/>

使用代理进行 TeamCity 服务器的出站连接

# For HTTP protocol
## The domain name or the IP address of the proxy host and the port:
teamcity.http.proxyHost=proxy.domain.com
teamcity.http.proxyPort=8080

## The hosts that should be accessed without going through the proxy, usually internal hosts. Provide a list of hosts, separated by the '|' character. The wildcard '*' can be used:
teamcity.http.nonProxyHosts=localhost|*.mydomain.com

## For an authenticated proxy add the following properties:
### Authentication type. "basic" and "ntlm" values are supported. The default is "basic".
teamcity.http.proxyAuthenticationType=basic
### Login and Password for the proxy. Used only with the "basic" auth type
teamcity.http.proxyLogin=login
teamcity.http.proxyPassword=password
### Windows NT credentials for NTLM authentication. Used only with the "ntlm" auth type
teamcity.http.proxyAuthentication=NT_credentials

# For HTTPS protocol
## The domain name or the IP address of the proxy host and the port:
teamcity.https.proxyHost=proxy.domain.com
teamcity.https.proxyPort=8080

## The hosts that should be accessed without going through the proxy, usually internal hosts. Provide a list of hosts, separated by the '|' character. The wildcard '*' can be used:
teamcity.https.nonProxyHosts=localhost|*.mydomain.com

## For an authenticated proxy add the following properties:
### Authentication type. "basic" and "ntlm" values are supported. The default is "basic".
teamcity.https.proxyAuthenticationType=basic
### Login and Password for the proxy. Used only with the "basic" auth type
teamcity.https.proxyLogin=login
teamcity.https.proxyPassword=password
### Windows NT credentials for NTLM authentication. Used only with the "ntlm" auth type
teamcity.https.proxyAuthentication=NT_credentials

使用代理进行出站构建代理连接

## The domain name or the IP address of the proxy host and the port
teamcity.http.proxyHost=123.45.678.9
teamcity.http.proxyPort=8080

## If the proxy requires authentication, specify the login and password
teamcity.http.proxyLogin=login
teamcity.http.proxyPassword=password

要访问 HTTPS 端点（例如，托管在 GitHub 上的存储库），还需配置 teamcity.https.* 属性。

See also

Administrator's Guide

配置代理服务器﻿

在代理服务器后面设置 TeamCity 服务器﻿

tip

Apache﻿

NGINX﻿

IIS﻿

其他服务器﻿

常见配置错误﻿

TeamCity Tomcat 配置﻿

使用代理进行 TeamCity 服务器的出站连接﻿

tip

使用代理进行出站构建代理连接﻿

tip

用于多节点设置的代理服务器﻿