Helm: Configuring LOADBALANCER_IPS

Zulip requires that the IP addresses of any reverse proxies in front of it be listed in LOADBALANCER_IPS. Zulip uses this list to decide whose X-Forwarded-For and X-Forwarded-Proto headers to trust; requests carrying those headers from a source IP that is not in the list are rejected with a “configure your reverse proxy” error page.

In a Kubernetes deployment, the reverse proxy in front of Zulip is typically the Ingress controller. The Helm chart leaves LOADBALANCER_IPS unset by default; you must set it to your Ingress controller’s pod IP, Service IP, or CIDR before user traffic will be served.

If you’re seeing the “configure your reverse proxy” error page

Zulip’s error page tells you to add the request’s source IP to LOADBALANCER_IPS. In a Helm install, that means setting zulip.environment.LOADBALANCER_IPS in your values file:

zulip:
  environment:
    LOADBALANCER_IPS: 10.244.0.0/16

Then upgrade the release:

helm upgrade --install zulip oci://ghcr.io/zulip/helm-charts/zulip \
    -f values-local.yaml

The value to use is whatever IP Zulip’s error page names as the source of the rejected request; consult your Ingress controller’s documentation if you need a more stable CIDR than a single ephemeral pod IP.

Upgrading from chart 1.x

Chart 1.x defaulted TRUST_GATEWAY_IP: true, which trusted the pod’s default gateway as the proxy IP. That heuristic was unreliable across CNIs (e.g. on Calico the gateway is the link-local 169.254.1.1, not the actual source of incoming traffic), so the default was removed in chart 2.0. The env var itself is still available as zulip.environment.TRUST_GATEWAY_IP: true for operators who want to opt back in, but LOADBALANCER_IPS is the recommended approach.

See also