DevOps tip: if your Docker container talks to an nginx reverse proxy on the same host, make sure trusted-proxies includes your Docker bridge subnet (usually 172.17.0.0/16). Without it, apps like GoToSocial silently break federation because they see all requests coming from 172.17.0.1 instead of the real client IP. Cost me an afternoon.