Vaultwarden

access_control:
 default_policy: deny
 rules:
    - domain: "*.mydomain.xyz"
 resources:
        - "^/api([/?].*)?$"
 policy: bypass
    - domain:
        - "*.mydomain.xyz"
    - domain: "vaultwarden.mydomain.xyz"
 resources:
        - "^*/admin.*$"
 policy: one_factor
    - domain:
        - "vaultwarden.mydomain.xyz"
 policy: bypass