So what I’m going to try and do is to use Cloudflare as a proxy for the apps (so the apps would use a different domain name than the web interfaces). Cloudflare supports proxying with TLS mutual authentication so my server would not be accessible without a certificate. I would also only allow Cloudflare to proxy the specific domain that I would use with bitwarden and not any other domain I might have pointing to my machine.
The only downside is that Cloudflare uses it’s own client certificate so now your server has to trust Cloudflare. But to me that seems acceptable.