could this nginx thing be my problem you think?
server {
listen 80;
server_name matrix.example.com;
return 301 https://$server_name$request_uri;
}

server {
listen 443 ssl;
listen [::]:443 ssl;
server_name matrix.example.com;

ssl_certificate /etc/letsencrypt/live/matrix.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/matrix.example.com/privkey.pem;

# If you don't wanna serve a site, comment this out
root /var/www/html;
index index.html index.htm;

location /_matrix {
  proxy_pass http://127.0.0.1:8008;
  proxy_set_header X-Forwarded-For $remote_addr;
}

}

change the listen address in the bridge's config file to 127.0.0.1 (instead of 0.0.0.0) and add this to your nginx config:

location /api {
    proxy_pass http://localhost:4501;
    proxy_set_header X-Forwarded-For $remote_addr;
}

then your domain will be matrix.example.org. Changing this isn't impossible, but more involved than a single chat message :p