diff --git a/mario/ansible/roles/services/tasks/main.yml b/mario/ansible/roles/services/tasks/main.yml
index cf1378a..11877d2 100644
--- a/mario/ansible/roles/services/tasks/main.yml
+++ b/mario/ansible/roles/services/tasks/main.yml
@@ -116,6 +116,9 @@
 
 # 'CONFIG = array' below is an arbitrary choice, it's just something that always
 # should exist in the Nextcloud config file
+#
+# `occ config:system:set` is probably a better way to do these config edits.
+# See docker-entrypoint.sh in https://github.com/nextcloud/docker/
 
 - name: Add phone region to Nextcloud config
   lineinfile:
diff --git a/mario/ansible/roles/services/templates/ops/nextcloud/compose.yml b/mario/ansible/roles/services/templates/ops/nextcloud/compose.yml
index 44c1c89..496ca7a 100644
--- a/mario/ansible/roles/services/templates/ops/nextcloud/compose.yml
+++ b/mario/ansible/roles/services/templates/ops/nextcloud/compose.yml
@@ -11,7 +11,8 @@ services:
       REDIS_HOST: redis
       REDIS_HOST_PASSWORD: redispassword
       OVERWRITEPROTOCOL: https
-      TRUSTED_PROXIES: traefik-reverse-proxy-1
+      OVERWRITECLIURL: https://cloud.{{ lookup('env', 'MARIO_DOMAIN_NAME') }}
+      TRUSTED_PROXIES: 172.18.0.0/16
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.nc-https.entrypoints=websecure"