Running CryptPad in a FreeBSD VNET jail with isolated networking, NAT via PF, and Caddy for TLS termination.