For Headscale, I don’t have any direct experience but unRAID has a decent Wireguard plugin, and should get you up and running in a pinch.
And for your self-hosted services (especially Bitwarden) ensure you’re not exposing this on the net, by VPN is the only option I’d recommend. Even so, I prefer to use Bitwarden’s hosting with a family plan, for peace of mind and resiliency. It’s also much easier for my family.
UnRAID is a great place to start - it allows you to scale cheaply as you need and is easier to fix mistakes. Good luck, and happy homelabbing!