I gave up with this attempt and used vaultwarden by itself with alternatively generated SSL, no issues.