Reverse Proxy Setup

The only supported way to run Arminius is with a reverse proxy, Arminius does not support TLS natively.

The Helm chart provides a reverse proxy setup through Gateway API HTTPRoutes. Each HTTP component’s httpRoute block in charts/arminius/values.yaml sets its hostnames and, optionally, its own Gateway. Routes without their own Gateway attach to the one in httpRoute.parentRefs. The chart README describes these values.

For any other reverse proxy, forward requests:

• To /arminius/admin/ to the admin service
• To /_matrix/client/ to the client service
• To /.well-known/matrix/client to the client service
• To /_matrix/federation/ to the federation-input service
• To /_matrix/key/ to the federation-input service
• To /.well-known/openid-configuration, /oauth/, /login/ and /scim/ to the Nuss service

Forwarded IPs

Arminius gets client IP addresses from the X-Forwarded-For header. Since Arminius only supports running in a reverse proxy, it trusts any such header it receives, no matter its origin. That means, if the reverse proxy allows external clients to pass X-Forwarded-For headers through the reverse proxy, it may be possible for clients to spoof their IP Address.