Alright, I wanted to come back now that my setup is complete... special thanks to those of you who suggested nginx-proxy-manager - its very nicely put together and really makes reverse proxies a breeze...
Long story short, I just created a brand new VM... started with the proxy manager and built on top of that. Next up was my static Hugo website; it was too easy to point change Apache2's ports.conf to 8097 instead of 80, and use nginx-proxy-manager for the SSL certs... that one was basically plug and play.
The Bitwarden bit was a bit more involved, but not too bad... at first I just redirected traffic to the original (other machine) Bitwarden VM - but no one wants an extra VM to backup and support... so I went with a fork Docker of bitwarden_rs/vaultmaster - it comes w/ e-mail setup in the container, so one less thing to worry about... I had to swap around some docker-compose.yml ports and just point nginx-proxy-manager at it... this time, tho, I used the SSL certs from the docker; I didn't wanna dig in and remove what they already had running.
In the middle I was still fighting with myself and not taking ya'lls good suggestions - I tried to go the Cloudflared route; which is a cool service... but you can't tunnel root domains unless you're a paid user. Cloudflared tunnels would be great for exposing the Plex, TrueNAS, etc's of the world... but I didn't NEED/want subnets.
Thanks to the Beehaw community... TechHeart.life is up and running. :P (Don't worry, the Bitwarden is on a private domain. Phhhbbbbtttt.)