nginx + rocket.chat (docker): 502 error

i'm trying to set up a few open-source services on my domain with each one under their own subdomains. i'm using docker to run the services themselves and nginx as a reverse proxy. be aware that i am a noob when it comes to all of these things

i already have gitea and peertube working, but i'm trying to set up rocket.chat under the subdomain "chat" and when i try to access it i get a 502 error. i have rocket.chat running on port 5000

here are my relevant files:

docker-compose.yml:

version: "3.3"
services:
  db:
    image: mongo:4.4.19
    volumes:
      - ./data/runtime/db:/data/db
      - ./data/dump:/dump
    command: mongod

  rocketchat:
    image: rocketchat/rocket.chat:5.4.4
    environment:
      - MONGO_URL=mongodb://db:27017/rocketchat
      - ROOT_URL=https://chat.my.domain
      - Accounts_UseDNSDomainCheck=False
    links:
      - db:db
    ports:
      - "5000:3000"
    depends_on:
      - db

.env:

### Rocket.Chat configuration

# Rocket.Chat version
# see:- https://github.com/RocketChat/Rocket.Chat/releases
RELEASE=5.4.4
# MongoDB endpoint (include ?replicaSet= parameter)
#MONGO_URL=
# MongoDB endpoint to the local database
#MONGO_OPLOG_URL=
# IP to bind the process to
#BIND_IP=
# URL used to access your Rocket.Chat instance
ROOT_URL=https://chat.my.domain
# Port Rocket.Chat runs on (in-container)
PORT=3000
# Port on the host to bind to
HOST_PORT=5000

### MongoDB configuration
# MongoDB version/image tag
#MONGODB_VERSION=
# See:- https://hub.docker.com/r/bitnami/mongodb

### Traefik config (if enabled)
# Traefik version/image tag
#TRAEFIK_RELEASE=
# Domain for https (change ROOT_URL & BIND_IP accordingly)
#DOMAIN=
# Email for certificate notifications
#LETSENCRYPT_EMAIL=

/etc/nginx/sites-available/rocketchat:

upstream backend {
    server 127.0.0.1:5000;
}

server {
    server_name chat.my.domain;
    
    client_max_body_size 200M;

    location / {
        proxy_pass http://backend/;
        
    proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;

        proxy_set_header HOST $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;

    proxy_redirect off;
    }


    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/chat.my.domain/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/chat.my.domain/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}


server {
    if ($host = chat.my.domain) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name chat.my.domain;
    listen 80;
    return 404; # managed by Certbot


}

edit: updated files (they still don't work)