When a reverse proxy sits in front of an app that accepts long uploads, the default client_body_timeout of 60 seconds is usually the first thing that breaks. Raise it per location, not globally.
Switching congestion control to BBR with the fq qdisc is a two-line sysctl change and noticeably smooths throughput on lossy routes.
Never deploy :latest to production. Pin a tag, test the next one on a canary, then roll out.