Try to check out the wiki article here
Basically Vaultwarden can be spun up on a server of your choice (Disk station) and configured with a reverse proxy for SSL termination. SSL can either be a self-signed certificate (but would require you to add these to your trusted certificate store) or can also be used with valid cert using DNS only ACME.
All you would need to do is not forward any ports on your router/firewall to keep it private to LAN only access, and can also be used and accessed over VPN as long as your VPN has firewall rules to pass traffic from the VPN network to your main LAN.