Vaultwarden hinter NGINX Reverse Proxy: NGINX Default Website anstatt Vaultwarden

docker ps -a

#Vaultwarden
upstream vaultwarden-default {
        zone vaultwarden-default 64k;
        server 127.0.0.1:8444;
                #keepalive 2;
}
map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;  
}
server {
        listen          443 ssl http2;
        listen          [::]:443 ssl http2;
        server_name     vault.TLD;

        ssl_certificate         /opt/ejb-ssl/wildcard.TLD/cert.crt;
        ssl_certificate_key     /opt/ejb-ssl/wildcard.TLD/key.key;
        add_header Strict-Transport-Security "max-age=3153600" always;  

        # Logging
        access_log /var/log/nginx/vault.TLD.access.log;
        error_log /var/log/nginx/vault.TLD.error.log;

        #Reverse Proxy
        location /vault/ {
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection $connection_upgrade;
                proxy_set_header Host $Host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                #proxy_set_header X-Forwarded-Proto  $schema;
                proxy_pass http://vaultwarden-default;
                #proxy_pass http:{{comment_single_line_double_slash:1}}
        }
}
#HTTP redirect to HTTPS
server {
        listen          80;
        listen          [::]:80;
        server_name     vault.TLD;
        if ($host = TLD) {
                return 301 https://vault.TLD$request_uri;
        }
        return 404;
}

version: '3'  

services:
  vaultwarden:
    container_name: vaultwarden
    image: vaultwarden/server:latest
    restart: unless-stopped
    volumes:
      - ./vw-data/:/data/
    ports:
      - 8444:80
      - 3012:3012
    environment:
      - LOG_FILE=/data/vaultwarden.log
      - WEBSOCKET_ENABLED=true
      - DOMAIN=https://vault.TLD/vault