Maybe an Atom?

I think you can also use

services:
  vaultwarden:
    expose: 
      - 80

And use 80 instead of 11808 in the caddy file.

Then the port will be available internally for caddy but not to the outside world. That may also need a network created in docker though. I’m on my phone so I can’t check the finer details at the moment.