u/Dangerous_Sir_6105

I’m trying to determine whether this is a Sophos WAF config issue or if I’m missing something.
Architecture: client -> Sophos WAF -> Nginx Flask API. Here’s what I’ve observed: the application works perfectly when accessed directly on the internal network, GET and the CORS OPTIONS preflight reach Nginx successfully, but the actual PATCH/Post with formdata request never reaches Nginx (no access log entry). The browser receives a 403 Forbidden with a generic Apache error page, so I suspect the Sophos WAF is rejecting it before forwarding.

Questions: has anyone seen Sophos WAF block PATCH requests by default or via protection policy?
Which logs or settings should I check to identify the exact rule causing the block, and is there a way to temporarily put the WAF policy into monitor only to confirm it’s the WAF rejecting it?

I came across this post, and the comments are full of conflicting opinions.
Could someone with hands-on experience building LLM systems explain how they’d approach this to get the most out of the available resources? I’m looking for practical insights, not theory. Let’s keep it constructive, we’re all here to learn.
Also, what’s currently the most capable LLM for a local setup?