Deploying .NET 9 Web Applications on cPanel Ubuntu Servers with Docker, Jenkins, and Apache Reverse Proxy

Running modern containerized .NET 9 enterprise applications on a traditional cPanel-managed Ubuntu server introduces unique architectural challenges. When combining a Dockerized .NET runtime, a Jenkins CI/CD pipeline, Apache as a reverse proxy, and cPanel's automated configuration rebuilds, developers frequently run into 502 Bad Gateway, 403 Forbidden, and cryptographic token decryption loops (such as MissingMethodException on TimeConstantBuffersAreEqual).

This comprehensive guide walks through an end-to-end solution for establishing a stable, production-ready deployment pipeline for a .NET 9 application on a cPanel Ubuntu server without modifying source logic.

Ensuring Proper Kestrel Interface Binding

By default, .NET containers can sometimes restrict network listeners to localhost if explicit URL bindings are omitted, causing Apache reverse proxies to fail with bad gateway errors.

In your Jenkins deployment script, explicitly pass the environment variable ASPNETCORE_URLS bound to all network interfaces (0.0.0.0:8080) within the container:

Groovy

sh 'docker run -d --restart always --name ntl-oneclick-web --env "ASPNETCORE_ENVIRONMENT=Production" --env "ASPNETCORE_URLS=http://0.0.0.0:8080" -p 8081:8080 ntl-oneclick-web:latest'

Bypassing cPanel Rebuild Overrides with Apache Post-Vhost Includes

cPanel routinely overwrites individual domain configuration files during system updates, which frequently strips out manual proxy rules and triggers 403 Forbidden errors. To make proxy configurations permanent, manage them globally using Apache's post-vhost include files.

Open the global post-vhost configuration file:

Bash

sudo nano /etc/apache2/conf.d/includes/post_vhost.conf

Add dedicated virtual host blocks for both HTTP (*:<port>) and HTTPS (*:443) traffic to handle secure proxy routing seamlessly:

Apache

<VirtualHost *:80>
    ServerName ntloneclickdi.com
    ServerAlias www.ntloneclickdi.com
    
    ProxyRequests Off
    ProxyPreserveHost On
    
    <Proxy *>
        Require all granted
    </Proxy>
    
    RequestHeader set X-Forwarded-Proto "http"
    RequestHeader set X-Forwarded-Port "80"
    
    ProxyPass / http://127.0.0.1:8081/ timeout=600
    ProxyPassReverse / http://127.0.0.1:8081/
</VirtualHost>

<VirtualHost *:443>
    ServerName ntloneclickdi.com
    ServerAlias www.ntloneclickdi.com
    
    SSLEngine on
    
    ProxyRequests Off
    ProxyPreserveHost On
    
    <Proxy *>
        Require all granted
    </Proxy>
    
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
    
    ProxyPass / http://127.0.0.1:8081/ timeout=600
    ProxyPassReverse / http://127.0.0.1:8081/
</VirtualHost>

Test the configuration syntax and restart Apache using cPanel's service wrapper:

Bash

sudo apachectl configtest
sudo /usr/local/cpanel/scripts/restartsrv_httpd

Preserving Authentication and 2FA Sessions with Persistent Data Protection Keys

When containers are redeployed through Jenkins, ephemeral file systems cause generated Data Protection keys to wipe out. This invalidates existing user authentication cookies, antiforgery tokens, and Two-Factor Authentication (2FA) sessions, resulting in infinite login redirects.

Mount a persistent host directory into the container's data protection path in your Jenkinsfile:

Groovy

stage('Push and Deploy') {
    steps {                
        script {
            sh 'mkdir -p /home/ubuntu/aspnet-keys'
            sh 'docker stop ntl-oneclick-web || true'
            sh 'docker rm ntl-oneclick-web || true'
            
            sh 'docker run -d --restart always --name ntl-oneclick-web --env "ASPNETCORE_ENVIRONMENT=Production" --env "ASPNETCORE_URLS=http://0.0.0.0:8080" -v /home/ubuntu/aspnet-keys:/root/.aspnet/DataProtection-Keys --network mudassar -p 8081:8080 ntl-oneclick-web:latest'
        }
    }
}

Resolving Cross-Platform Cryptographic Package Version Skews (`NU1605`)

Migrating a .NET 9 solution from a Windows development machine to a Linux container environment often exposes transitive dependency mismatches. Mixing identity packages (e.g., combining v2.3 identity packages with v10 store packages) pulls mismatched internal cryptography binaries into the compilation graph. This triggers a runtime MissingMethodException regarding TimeConstantBuffersAreEqual under Linux case-sensitive file mapping.

To resolve this package skew, synchronize all Entity Framework, Identity, and Microsoft extension packages uniformly to version 9.0.15 across your domain and web project files:

XML

<ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.Identity" Version="2.3.0" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Abstractions" Version="9.0.15" />
    <PackageReference Include="Microsoft.Extensions.Identity.Stores" Version="9.0.15" />
</ItemGroup>

Clear old corrupted host keys and trigger a fresh, non-cached build to finalize your environment:

Bash

sudo rm -rf /home/ubuntu/aspnet-keys/*
docker build --no-cache -t ntl-oneclick-web:latest -f NTL-OneClick-DI-Web/Dockerfile .

Conclusion

By configuring explicit Kestrel URL binding, locking reverse proxy rules into Apache's global post-vhost hooks, mounting persistent host volumes for Data Protection keys, and synchronizing NuGet package trees to target version 9.0.15, you can reliably deploy modern .NET 9 web applications on Linux-based cPanel servers. This architecture completely eliminates 502/403 errors and preserves user session states seamlessly across automated Jenkins updates.

Ensuring Proper Kestrel Interface Binding

Bypassing cPanel Rebuild Overrides with Apache Post-Vhost Includes

Preserving Authentication and 2FA Sessions with Persistent Data Protection Keys

Resolving Cross-Platform Cryptographic Package Version Skews (NU1605)

Conclusion

Resolving Cross-Platform Cryptographic Package Version Skews (`NU1605`)