This. Also, make sure the proxy is proxying websocket traffic as well. I do it with pure nginx like this:

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass http://192.168.1.100:8123/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Thanks. I tried it like this and still get a 400 Bad Request error.

Someone below mentioned adding some more IPs to the trusted_proxies list so I tried that as well without result. The IP I used for the reverse-proxy is the IP listed in portainer under the network for the proxy container. Just to reiterate, the container is running on a different device than homeassistant (technically same device but different VM but that shouldn't make a difference).

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 192.168.208.2 # IP of reverse-proxy in its network
    - 192.168.208.0/20 # Subnet of proxy docker network
    - 192.168.1.103 # HA IP

Thanks for the configuration example. Unfortunately it doesn't seem to work for me. I've replied to someone above with screenshots of what my configuration now looks like. The base_url option you use there wasn't available to me because it apparently has been deprecated and replaced with internal_url and external_url.