The Cloudflare DNS challenge for certs is a nice touch — avoids exposing port 80 entirely. I set up Prosody a while back and the TURN/STUN config for voice calls was the part that tripped me up the most. coturn can be finicky with Docker networking if you're not careful about host mode vs bridged.