Also, vaultwarden requires HTTPS?? Ah drat, that’s not good :/ I don’t have experience with that.

Yes, the clients work only over HTTPS. Caddy can handle that:

vaultwarden.cosmos.internal {
        tls /opt/caddy/certificate.crt /opt/caddy/private.key
        handle /* {
                reverse_proxy http://localhost:8081/
        }
}

The certs need to be generated for this specific domain:

openssl req   -x509   -newkey rsa:4096   -keyout key.pem   -out cert.pem   -sha256   -days 36500   -nodes   -subj "/C=XX/ST=StateName/L=CityName/O=CompanyName/OU=CompanySectionName/CN=cosmos.internal"

Some more details are here: bitwarden.com/help/certificates/ under “Using a self-signed Certificate”