Archiva only needs a basic HTTP Proxy configuration with CloudFlare Origin SSL.
server { listen 0.0.0.0:80; listen [::]:80; listen 0.0.0.0:443 ssl http2; listen [::]:443 ssl http2; server_name mvn.felinewith.me; ## Replace this with something like gitlab.example.com server_tokens off; ## Don't show the nginx version number, a security best practice ssl on; ssl_certificate /***/cf_cert.pem; ssl_certificate_key /***/cf_key.key; access_log /var/log/nginx/archiva_access.log; error_log /var/log/nginx/archiva_error.log; rewrite ^/repository/([^/]+)/.index/(.*)? /repository/$1/.indexer/$2 last; location / { client_max_body_size 0; gzip on; gzip_static on; proxy_read_timeout 300; proxy_connect_timeout 300; proxy_redirect off; proxy_http_version 1.1; set $ssl off; if ($scheme = https) { set $ssl on; } proxy_set_header Host $http_host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $http_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Ssl $ssl; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade_gitlab; proxy_set_header REMOTE_ADDR $http_cf_connecting_ip; proxy_pass http://localhost:8880; } error_page 404 /404.html; error_page 422 /422.html; error_page 500 /500.html; error_page 502 /502.html; error_page 503 /503.html; location ~ ^/(404|422|500|502|503)\.html$ { root /home/git/gitlab/public; internal; } }