Operating the server
By default, the service will use the Java executable available on the Windows PATH. This setting can be changed by setting the environmental variable
SONAR_JAVA_PATH. See more in Adjusting the Java installation.
> <sonarqubeHome>\bin\windows-x86-64\SonarService.bat stop does a graceful shutdown where no new analysis report processing can start, but the tasks in progress are allowed to finish. The time a stop will take depends on the processing time of the tasks in progress. You'll need to kill all SonarQube processes manually to force a stop.
Check if the SonarQube service is running:
Stop does a graceful shutdown where no new analysis report processing can start, but the tasks in progress are allowed to finish. The time a stop will take depends on the processing time of the tasks in progress. Use force stop for a hard stop.
On a Unix system using systemd, you can install SonarQube as a service. You cannot run SonarQube as root in Unix systems. Ideally, you will have created a new account dedicated to the purpose of running SonarQube. Let's suppose:
- The user used to start the service is
- The group used to start the service is
- The Java Virtual Machine is installed in
- SonarQube has been unzipped into
Then create the file
/etc/systemd/system/sonarqube.service based on the following:
- Because the sonar-application jar name ends with the version of SonarQube, you will need to adjust the
ExecStartcommand accordingly on install and at each upgrade.
- All SonarQube directories should be owned by the
- If you have multiple Java versions, you will need to modify the
javapath in the
ExecStartcommand. This also means
SONAR_JAVA_PATHwill not work with SonarQube as a service.
sonarqube.service file is created and properly configured, run:
The following has been tested on Ubuntu 20.04 and CentOS 6.2.
You cannot run SonarQube as
root in 'nix systems. Ideally, you will have created a new account dedicated to the purpose of running SonarQube. Let's suppose the user used to start the service is
sonarqube. Then create the file
/etc/init.d/sonar based on the following:
Register SonarQube at boot time (RedHat, CentOS, 64 bit):
Register SonarQube at boot time (Ubuntu, 64 bit):
Once registration is done, run:
This section helps you configure the SonarQube Server if you want to run it behind a proxy. This can be done for security concerns or to consolidate multiple disparate applications. To run the SonarQube server over HTTPS, see the HTTPS Configuration section below.
For security reasons, we recommend only giving external access to the main port.
We assume that you've already installed Apache 2 with module mod_proxy, that SonarQube is running and available on
http://private_sonar_host:sonar_port/, and that you want to configure a Virtual Host for
At this point, edit the HTTPd configuration file for the
www.public_sonar.com virtual host. Include the following to expose SonarQube via
Apache configuration is going to vary based on your own application's requirements and the way you intend to expose SonarQube to the outside world. If you need more details about Apache HTTPd and mod_proxy, please see https://httpd.apache.org.
We assume that you've already installed Nginx, that you are using a Virtual Host for
www.somecompany.com and that SonarQube is running and available on
At this point, edit the Nginx configuration file. Include the following to expose SonarQube at
Nginx configuration will vary based on your own application's requirements and the way you intend to expose SonarQube to the outside world. If you need more details about Nginx, please see https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/.
Note that you may need to increase the max URL length since SonarQube requests can have URLs longer than 2048.
Using IIS on Windows, you can create a website that acts as a reverse proxy and access your SonarQube instance over SSL.
Because of possibly long query strings with SonarQube web API, you must increase the default
maxQueryString (default is 2048) and
maxQueryStringLength to much larger values. Otherwise, request filtering will be applied which can yield HTTP 404 errors; this may cause projects to not appear on the projects dashboard, for example.
To adjust these values, enter the “Request Filtering” module for your IIS site, right-click, select “Edit Feature Settings…”, and increase the “Maximum query string” value to a much larger value. Alternatively, you can add the following to your
web.config file for the associated IIS site (adjust
maxQueryStringLength as needed):
See Request Limits <requestLimits> | Microsoft Learn for more information.
- Internet Information Services (IIS) enabled. In the following example, IIS is enabled on the same machine as the SonarQube instance.
- The Url Rewrite extension for IIS
- The Application Based Routing extension for IIS
- A self-signed SSL certificate, or a real one
Note that you must import the self-signed certificate to the Java truststore of the machine running the scanner.
To make sure the extensions are enabled, restart your IIS Manager after you install them.
- In the IIS Manager, select Your machine > Sites > Add Website...
- Under Site name, enter a name for your website.
- Under Content Directory > Physical path, select a physical path for your website’s folder. Based on the default IIS website, we recommend creating a
%SystemDrive%\inetpub\wwwroot_sonarqubefolder and using it as a physical path.
- In Binding, select Type > https.
- For Host name, enter the hostname you will use to access SonarQube.
- Under SSL certificate, select an SSL certificate.
- Click OK.
Once you’ve created your website using the IIS Manager, you can use the URL Rewrite extension to use that website as a reverse proxy.
- From the IIS Manager home page, select your website and open URL Rewrite.
- Click Add Rule(s) to create a new rule.
- Select Reverse Proxy from the list of templates.
- Enter the destination server URL. It can be
localhost:9000or a remote server.
- Click OK to create the rule.
The URL Rewrite page now displays a reverse proxy inbound rule.
Using the URL Rewrite module, you can create a server variable to handle the
HTTP_X_FORWARDED_PROTO header and pass it to SonarQube. See the HTTPS Configuration section on this page for more information on that server variable.
From the URL Rewrite page:
- Click View Server Variables. This opens the Allowed Server Variables page.
- To add a server variable, click Add..., enter
HTTP_X_FORWARDED_PROTOin the field and click OK. The server variable is now displayed on the Allowed Server Variables page.
- Click Back to Rules to go to the URL Rewrite rules list.
- Select the reverse proxy inbound rule for your website. Under Inbound Rules, click Edit.
- Expand the Server variables section of the rule definition.
- Add the
HTTP_X_FORWARDED_PROTOserver variable and give it the value https.
- Apply the changes.
SonarQube can now be accessed over SSL.
For SAML through IIS, you must perform the following additional steps:
- Make sure the host headers are preserved. This is set at the IIS server level, by executing the following command:
%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/proxy -preserveHostHeader:true /commit:apphostYou should then see an output that says something like:
Applied configuration changes to section "system.webServer/proxy" for "MACHINE/WEBROOT/APPHOST" at configuration commit path "MACHINE/WEBROOT/APPHOST"
- Disable the Reverse rewrite host in the response headers as follows:
- At the server level in IIS, go to Application Request Routing > Server proxy settings.
- Uncheck the box Reverse rewrite host in response headers.
- Apply the change.
- Restart IIS.
With your SonarQube instance and your IIS website running, open the IIS Manager and click the link under Your website > Browse Website > Browse, or enter the website’s URL in a browser. You should see the login or home page of your SonarQube instance.
You can configure your SonarQube instance to only accept traffic from your reverse proxy, by adding the following line to the
Another option is to use the Windows Firewall to only accept traffic from localhost.
The setup described here is inspired by this Configure SSL for SonarQube on Windows blog post.
SonarQube adds custom HTTP headers. The reverse proxy should be configured to forward the following headers:
This header is added to a web service response when using tokens to authenticate. Forwarding this header is not required for the SonarQube features to work properly.
This header is used to verify the integrity of the plugins downloaded by the scanner. You must forward this header to successfully execute analyses that use plugins.
To further lock down the communication in between the reverse proxy and SonarQube, you can define the following network rules:
You can further segment your network configuration if you specify a frontend network and keep Elasticsearch restricted to the loopback NiC.
|Frontend HTTP Network