diff --git a/.env.production.sample b/.env.production.sample
index fd2f71165ab9212b3747bea4ea214fb750c04984..1125eedbff5eb713f4cbb716e7f9719bfc9151d8 100644
--- a/.env.production.sample
+++ b/.env.production.sample
@@ -11,6 +11,10 @@ DB_PORT=5432
 LOCAL_DOMAIN=example.com
 LOCAL_HTTPS=true
 
+# Use this only if you need to run mastodon on a different domain than the one used for federation.
+# Do not use this unless you know exactly what you are doing.
+# WEB_DOMAIN=mastodon.example.com
+
 # Application secrets
 # Generate each with the `rake secret` task (`docker-compose run --rm web rake secret` if you use docker compose)
 PAPERCLIP_SECRET=
diff --git a/app/controllers/api/push_controller.rb b/app/controllers/api/push_controller.rb
index 78d4e36e6913b679365914df9322ad5b1d8d514b..f2ddfd969ee54de5ec87760bc47ec5cc43d05b70 100644
--- a/app/controllers/api/push_controller.rb
+++ b/app/controllers/api/push_controller.rb
@@ -30,7 +30,7 @@ class Api::PushController < ApiController
     params = Rails.application.routes.recognize_path(uri.path)
     domain = uri.host + (uri.port ? ":#{uri.port}" : '')
 
-    return unless TagManager.instance.local_domain?(domain) && params[:controller] == 'accounts' && params[:action] == 'show' && params[:format] == 'atom'
+    return unless TagManager.instance.web_domain?(domain) && params[:controller] == 'accounts' && params[:action] == 'show' && params[:format] == 'atom'
 
     Account.find_local(params[:username])
   end
diff --git a/app/lib/tag_manager.rb b/app/lib/tag_manager.rb
index 07b2fb91e01645a45d635b8d60fe3efb53dff0f7..f26c943d25670373a790549d124145e6c35cb00e 100644
--- a/app/lib/tag_manager.rb
+++ b/app/lib/tag_manager.rb
@@ -56,6 +56,10 @@ class TagManager
     id.start_with?("tag:#{Rails.configuration.x.local_domain}")
   end
 
+  def web_domain?(domain)
+    domain.nil? || domain.gsub(/[\/]/, '').casecmp(Rails.configuration.x.web_domain).zero?
+  end
+
   def local_domain?(domain)
     domain.nil? || domain.gsub(/[\/]/, '').casecmp(Rails.configuration.x.local_domain).zero?
   end
diff --git a/app/services/process_feed_service.rb b/app/services/process_feed_service.rb
index a2def453513512f7a6389869681441ac0ccd8873..321f53f22e60461dc0e757757e66d9c9204489d7 100644
--- a/app/services/process_feed_service.rb
+++ b/app/services/process_feed_service.rb
@@ -163,7 +163,7 @@ class ProcessFeedService < BaseService
 
         url = Addressable::URI.parse(link['href'])
 
-        mentioned_account = if TagManager.instance.local_domain?(url.host)
+        mentioned_account = if TagManager.instance.web_domain?(url.host)
                               Account.find_local(url.path.gsub('/users/', ''))
                             else
                               Account.find_by(url: link['href']) || FetchRemoteAccountService.new.call(link['href'])
diff --git a/config/initializers/ostatus.rb b/config/initializers/ostatus.rb
index fb0b8b7fe328417f4935a3e488df9657a6559a7a..155d0a9f1a8c8bf256bfd728406ffeb830df9e0b 100644
--- a/config/initializers/ostatus.rb
+++ b/config/initializers/ostatus.rb
@@ -2,18 +2,20 @@
 
 port  = ENV.fetch('PORT') { 3000 }
 host  = ENV.fetch('LOCAL_DOMAIN') { "localhost:#{port}" }
+web_host = ENV.fetch('WEB_DOMAIN') { host }
 https = ENV['LOCAL_HTTPS'] == 'true'
 
 Rails.application.configure do
   config.x.local_domain = host
+  config.x.web_domain   = web_host
   config.x.use_https    = https
   config.x.use_s3       = ENV['S3_ENABLED'] == 'true'
 
-  config.action_mailer.default_url_options = { host: host, protocol: https ? 'https://' : 'http://', trailing_slash: false }
+  config.action_mailer.default_url_options = { host: web_host, protocol: https ? 'https://' : 'http://', trailing_slash: false }
   config.x.streaming_api_base_url          = 'http://localhost:4000'
 
   if Rails.env.production?
-    config.action_cable.allowed_request_origins = ["http#{https ? 's' : ''}://#{host}"]
-    config.x.streaming_api_base_url             = ENV.fetch('STREAMING_API_BASE_URL') { "http#{https ? 's' : ''}://#{host}" }
+    config.action_cable.allowed_request_origins = ["http#{https ? 's' : ''}://#{web_host}"]
+    config.x.streaming_api_base_url             = ENV.fetch('STREAMING_API_BASE_URL') { "http#{https ? 's' : ''}://#{web_host}" }
   end
 end