Use a self signed SSL cert

Use nginx to reverse proxy the vaultwarden instance

Use the hostname.local address to access the device or add a DNS override to your router. If that’s not an option update your hosts file on the machines you intend to use it from.

Also I can’t stress enough the ease of use of docker compose files for managing and quickly spinning up new apps.

For VPN home labbing you should check out wireguard, it’s stupid simple and very powerful. Reverse proxy stuff I handle through nginx, mostly because I’m using it for web hosting anyways and I’m comfortable with the workflow. I don’t bother with cloudflare much because I host a jellyfin instance and I believe that’s against their TOS, but just take it one step at a time and you’ll figure it out in no time.