Help configuring linuxserver SWAG container for vaultwarden (Bitwarden docker)

Having trouble with SWAP + DuckDNS config based on SpaceInvader's tutorials using mysubdoman.duckdns.org (I may add my own domain later, but leaving it as is for now) (DuckDNS subdomain changed for privacy/security)

abc123.duckdns.org resolves to my WAN IP correctly

swag & vaultwarden containers are on 'proxynet' network

swag 172.18.0.3:443/TCP <-> 192.168.111.61:1443 & 172.18.0.3:80/TCP <-> 192.168.111.61:180

vaultwarden 172.18.0.2:80/TCP <-> 192.168.111.61:4743

vaultwarden.subdomain.conf file (I've made changes here):

#BITWARDEN
# make sure that your domain has dns has a cname or a record set for the subdomain bitwarden 
# This config file will work as is when using a custom docker network the same as letesencrypt (proxynet).
# However the container name is expected to be "bitwardenrs" as it is by default the template as this name is used to resolve.  
# If you are not using the custom docker network for this container then change the line "server bitwardenrs:80;" to "server [YOUR_SERVER_IP]:8086;" Also remove line 7

#resolver 127.0.0.11 valid=30s;
upstream vaultwarden {
    server vaultwarden:80;
}

server {
    listen 443 ssl;
    server_name abc123.*;
    include /config/nginx/ssl.conf;
  client_max_body_size 128M;

  location / {
   proxy_pass http://vaultwarden;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
  
  location /notifications/hub {
   proxy_pass http://vaultwarden;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }
  
  location /notifications/hub/negotiate {
    proxy_pass http://vaultwarden;
  }
}