Set Dendrite's real_ip_header correctly

group_vars/matrix_servers

@@ -2231,6 +2231,8 @@ matrix_dendrite_container_http_host_bind_address: "{{ '' if matrix_nginx_proxy_e
 # For exposing Dendrite's HTTPS server to the local host.
 matrix_dendrite_container_https_host_bind_address: "{{ '' if matrix_nginx_proxy_enabled or not matrix_dendrite_https_bind_port else ('127.0.0.1:' + matrix_dendrite_https_bind_port|string) }}"
 
+matrix_dendrite_sync_api_real_ip_header: "{{ 'X-Forwarded-For' if matrix_nginx_proxy_enabled else '' }}"
+
 matrix_dendrite_registration_shared_secret: "{{ matrix_homeserver_generic_secret_key | password_hash('sha512', 'dendrite.rss') | to_uuid }}"
 
 matrix_dendrite_database_password: "{{ matrix_homeserver_generic_secret_key | password_hash('sha512', 'dendrite.db') | to_uuid }}"

roles/matrix-dendrite/defaults/main.yml

@@ -68,6 +68,10 @@ matrix_dendrite_allow_guest_access: false
 
 matrix_dendrite_max_file_size_bytes: 10485760
 
+# Controls which HTTP header (e.g. 'X-Forwarded-For', 'X-Real-IP') to inspect to find the real remote IP address of the client.
+# This is likely required if Dendrite is running behind a reverse proxy server.
+matrix_dendrite_sync_api_real_ip_header: ''
+
 # The tmpfs at /tmp needs to be large enough to handle multiple concurrent file uploads.
 matrix_dendrite_tmp_directory_size_mb: 500
 

roles/matrix-dendrite/templates/dendrite/dendrite.yaml.j2

@@ -339,6 +339,7 @@ sync_api:
   # address of the client. This is likely required if Dendrite is running behind
   # a reverse proxy server.
   # real_ip_header: X-Real-IP
+  real_ip_header: {{ matrix_dendrite_sync_api_real_ip_header|to_json }}
 
 # Configuration for the User API.
 user_api: