server {
    listen ipv4_1:443 quic reuseport;
    listen ipv4_1:443 ssl;
    listen [ipv6_1]:443 quic reuseport;
    listen [ipv6_1]:443 ssl;

    server_name vault.yourdomain.tld;

    ssl_certificate /etc/letsencrypt/live/vault.yourdomain.tld/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.yourdomain.tld/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/vault.yourdomain.tld/chain.pem;

    include snippets/universal_paths.conf;
    include snippets/hsts.conf;
    include snippets/security.conf;
    include snippets/cross-origin-security.conf;
    include snippets/quic.conf;
    include snippets/proxy.conf;

    location / {
        proxy_pass http://vaultwarden:8080;
    }
}