diff --git a/infra/occupymedia/edge/nginx.conf b/infra/occupymedia/edge/nginx.conf
index f357c8e..319cddd 100644
--- a/infra/occupymedia/edge/nginx.conf
+++ b/infra/occupymedia/edge/nginx.conf
@@ -289,6 +289,74 @@ http {
     }
   }
 
+  # Mastodon instance (social): web :3030 and streaming :4040 bound on the
+  # CT host LAN IP; federation clients hit the same vhost as browsers.
+  server {
+    listen 80;
+    listen [::]:80;
+    server_name social.occupymedia.cc;
+    location ~ ^/api/v1/streaming {
+      proxy_pass http://192.168.13.221:4040;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+      proxy_buffering off;
+    }
+    location / {
+      proxy_pass http://192.168.13.221:3030;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+      proxy_buffering off;
+      client_max_body_size 80m;
+    }
+  }
+
+  server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name social.occupymedia.cc;
+
+    ssl_certificate     /etc/letsencrypt/live/occupymedia.cc/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/occupymedia.cc/privkey.pem;
+
+    client_max_body_size 80m;
+    location ~ ^/api/v1/streaming {
+      proxy_pass http://192.168.13.221:4040;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+      proxy_buffering off;
+    }
+    location / {
+      proxy_pass http://192.168.13.221:3030;
+      proxy_http_version 1.1;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection $connection_upgrade;
+      proxy_read_timeout 3600s;
+      proxy_send_timeout 3600s;
+      proxy_buffering off;
+    }
+  }
+
   # Everything else on this IP: drop the connection.
   server {
     listen 443 ssl default_server;