I feel like I’m missing some EASY thing; like can’t my apache2 just route the bitwarden.domain1.com traffic to another local IP address…

Yes. It can. https://httpd.apache.org/docs/2.4/vhosts/name-based.html

If you’re going to be jumping straight into text based config files… Caddy’s Caddyfile format is a lot easier to work with then nginx configs IMO.

Cloudflare tunnel free is pretty good, and I use it for my on-prem (in house) services because it can work through CGNAT, though you are subject to the standard cloudflare terms of use.

On the other hand, what you’re looking for is called a reverse proxy. I’d recommend Caddy or Nginx Proxy Manager for you.

I personally use Traefik, but I’m also running on a kubernetes cluster so…