@castaway@fosstodon.org Sure. I'm using the Docker version, and it comes broken. Mobilizon ships with paranoid privacy. Specifically, it uses: "Referrer-Policy: same-origin" which is not supported by *.tile.openstreetmap.org, the map provider they also choose as their default. openstreetmap wants a referrer so they have some control over abuse and scraping. It will accept a referrer that consists solely of the site's origin, in my case "https[:]//my-group.events/", which doesn't violate any user privacy. It doesn't forward slugs, paths, or query parameters, so privacy concerns should be addressed with this policy. So, you need to use "Referrer-Policy: strict-origin-when-cross-origin" instead to pass along the domain name. The default passes nothing. The problem is that it's not a good idea to modify the Docker containers directly and update the configuration files, as they get reset with each update. Instead, you can have Nginx discard and replace the Referrer-Policy before sending. For reference, here's my Nginx configuration, which uses "proxy_hide_header" to remove what is passed in by default. # Map block to handle WebSockets dynamically map $http_upgrade $connection_upgrade { default upgrade; '' close; } # Redirect HTTP to HTTPS server { listen 80; listen [::]:80; server_name my-group.events; return 301 https://$host$request_uri; } # HTTPS Server server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name my-group.events; # SSL Configuration ssl_certificate /etc/letsencrypt/live/my-group.events/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/my-group.events/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; ssl_trusted_certificate /etc/letsencrypt/live/my-group.events/chain.pem; ssl_stapling on; ssl_stapling_verify on; ssl_ecdh_curve prime256v1; # Security Headers (Sent to Client) add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; # Strip upstream security headers from Mobilizon/Phoenix to eliminate duplicates proxy_hide_header Referrer-Policy; proxy_hide_header X-Content-Type-Options; proxy_hide_header X-XSS-Protection; # Gzip Compression gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml image/svg+xml; client_max_body_size 16m; # Global Proxy Settings proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Port $server_port; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; # Main Application location / { proxy_pass http://127.0.0.1:4000; } # Static Media and Proxy Assets location ~ ^/(media|proxy) { etag off; access_log off; # Re-apply security headers due to Nginx block inheritance behavior add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Cache-Control "public, max-age=31536000, immutable"; proxy_pass http://127.0.0.1:4000; } } If you aren't using Docker, it's still the same concept.