diff --git a/app/ui.py b/app/ui.py
index 120c52f..9993ddb 100644
--- a/app/ui.py
+++ b/app/ui.py
@@ -712,17 +712,18 @@ def object_presign(bucket_name: str, object_key: str):
     except IamError as exc:
         return jsonify({"error": str(exc)}), 403
     
-    api_base = current_app.config.get("API_BASE_URL")
-    if not api_base:
-        api_base = "http://127.0.0.1:5000"
-    api_base = api_base.rstrip("/")
-    
-    url = f"{api_base}/presign/{bucket_name}/{object_key}"
+    # Use internal URL for the connection to ensure reliability
+    # We ignore API_BASE_URL here because that might be set to a public domain
+    # which is not reachable from within the container (NAT/DNS issues).
+    connection_url = "http://127.0.0.1:5000"
+    url = f"{connection_url}/presign/{bucket_name}/{object_key}"
     
     headers = _api_headers()
     # Forward the host so the API knows the public URL
+    # We also add X-Forwarded-For to ensure ProxyFix middleware processes the headers
     headers["X-Forwarded-Host"] = request.host
     headers["X-Forwarded-Proto"] = request.scheme
+    headers["X-Forwarded-For"] = request.remote_addr or "127.0.0.1"
     
     try:
         response = requests.post(url, headers=headers, json=payload, timeout=5)
diff --git a/templates/docs.html b/templates/docs.html
index 6f0dd40..ea559c2 100644
--- a/templates/docs.html
+++ b/templates/docs.html
@@ -31,14 +31,61 @@
 . .venv/Scripts/activate      # PowerShell: .\\.venv\\Scripts\\Activate.ps1
 pip install -r requirements.txt
 
-# Run both API and UI
+# Run both API and UI (Development)
 python run.py
 
+# Run in Production (Waitress server)
+python run.py --prod
+
 # Or run individually
 python run.py --mode api
 python run.py --mode ui
 </code></pre>
-        <p class="small text-muted mb-0">Configuration lives in <code>app/config.py</code>; override variables via the shell (e.g., <code>STORAGE_ROOT</code>, <code>API_BASE_URL</code>, <code>SECRET_KEY</code>, <code>MAX_UPLOAD_SIZE</code>).</p>
+        <h3 class="h6 mt-4 mb-2">Configuration</h3>
+        <p class="text-muted small">Configuration defaults live in <code>app/config.py</code>. You can override them using environment variables. This is critical for production deployments behind proxies.</p>
+        <div class="table-responsive">
+          <table class="table table-sm table-bordered small mb-0">
+            <thead class="table-light">
+              <tr>
+                <th>Variable</th>
+                <th>Default</th>
+                <th>Description</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr>
+                <td><code>API_BASE_URL</code></td>
+                <td><code>http://127.0.0.1:5000</code></td>
+                <td>The public URL of the API. <strong>Required</strong> if running behind a proxy or if the UI and API are on different domains. Ensures presigned URLs are generated correctly.</td>
+              </tr>
+              <tr>
+                <td><code>STORAGE_ROOT</code></td>
+                <td><code>./data</code></td>
+                <td>Directory for buckets and objects.</td>
+              </tr>
+              <tr>
+                <td><code>MAX_UPLOAD_SIZE</code></td>
+                <td><code>5 GB</code></td>
+                <td>Max request body size.</td>
+              </tr>
+              <tr>
+                <td><code>SECRET_KEY</code></td>
+                <td>(Random)</td>
+                <td>Flask session key. Set this in production.</td>
+              </tr>
+              <tr>
+                <td><code>APP_HOST</code></td>
+                <td><code>0.0.0.0</code></td>
+                <td>Bind interface.</td>
+              </tr>
+              <tr>
+                <td><code>APP_PORT</code></td>
+                <td><code>5000</code></td>
+                <td>Listen port.</td>
+              </tr>
+            </tbody>
+          </table>
+        </div>
       </div>
     </article>
     <article id="auth" class="card shadow-sm docs-section">