Flask WTForms don't always submit (gunicorn + nginx)

Question

I recently migrated my site to another environment (PythonAnywhere to Vultr) and need to set servers up myself now. I've gotten everything running, but I've noticed my form POSTs don't always submit. It seems like 50% of POSTs work, and the other 50% don't. It doesn't matter if the page is refreshed or not, each submission's success seems completely random. I didn't have this problem with PythonAnywhere, or while developing the site locally on Windows, so I suspect it's an issue with NGINX and/or gunicorn configs.

main.py - the route that submits 50/50. The other form routes have the same strange behaviour - they don't always submit, and the form remains filled out.:

@app.route("/", methods=["GET", "POST"])
def home():
    form = CommentForm()

    if form.validate_on_submit():
        create_entry(form.comment.data)
        flash('<img src="/static/media/thank_you.jpg"/><h1>Thank you!</h1>')
        return redirect(url_for("home"))

    return render_template(
        "home.html", form=form, comments=get_comments(),
    )

home.html - the flash snippet which sometimes displays the <img> and <h1> flash message:

{% with messages = get_flashed_messages() %}
    {% if messages %}
      {% for message in messages %}
        {{ message | safe }} <!-- safe used to render <img> and <h1> -->
      {% endfor %}
    {% endif %}
    {% endwith %}
    {% block body %}{% endblock %}

/etc/systemd/system/gunicorn.service:

[Unit]
Description=gunicorn daemon
After=network.target

[Service]
User=sammy
Group=www-data
WorkingDirectory=/home/ubuntu/NAME.com
Environment="PATH=/home/ubuntu/venv_flask/bin"
ExecStart=/home/ubuntu/venv_flask/bin/gunicorn -w 2 -b 127.0.0.1:9001 'main:app'

[Install]
WantedBy=multi-user.target

/etc/nginx/sites-enabled:

server {
    server_name NAME.com www.NAME.com;
    root /home/ubuntu/NAME.com;

    location / {
        proxy_pass http://127.0.0.1:9001/;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Prefix /;
        # tried adding `proxy_set_header Cookie $http_cookie;` with no luck
    }
}

Edits

I've added an extra worker (3 in total now), and uninstalled docker completely. I feel like maybe is a hardware limitation... Will keep investigating.

Nope, resources seem OK...

! The code gets to form.validate_on_submit() and it evaluates to False for some reason...

Aha!

{'csrf_token': ['The CSRF token is invalid.']}

This question should be left open to help others who make similar searches. It provides guidance on debugging, and the way this question is asked is unique - it's arguably NOT a duplicate. The answer to my question is related to the posted duplicate question, but THE QUESTION IS NOT A DUPLICATE. Mind your own business and leave my genuine and appropriate questions open!

Answer 1

With my local and PythonAnywhere instances, I was using app.secret_key = os.urandom(16). Somehow this worked... maybe because those instances only used one worker? In any case, setting app.secret_key = <CONSTANT> worked and resolved the hiddent CSRF error I was getting.