There’s actually a point of doing that, it’s called lock down, but how to explain users how to do this 😆

For bitwarden functionality there are bypass rules on just a nginx location, or network somebody is reaching through

In general the situation reminds me using selfhosted email as a contact email for that hosting 😁 but I think in this case it’s less risk because I control the data