The clients cache the vault locally whenever they are connected to the server (at least I think they do. The mobile apps for sure, the desktop app probably too, the browser extension im not sure). Adding entries without server connection simply won’t work though, so if you can you should somehow make the server accessible from outside your LAN.

There are only a few services I host that are publicly accesible, and I put those on a 12 dollar per year virmach vps. One of those is vaultwarden. Some others are gotify, wallabag, hauk, and remotely. I don’t think it’s a problem to run vaultwarden on your lan only because it will sync changes when you connect and resolve any conflicts. I have it accessible from the internet to encourage friends and family to use a password manager with as few hurdles as possible. I’ve found it to be easy to administrate and secure. In fact, I just moved it from my cancelled dedipath vps to my virmach vps yesterday with zero issues and about 5 minutes of downtime.

Yes, I have it under a subdomain I own on cloudflare. Then it’s behind nginx proxy manager on my server which takes care of the ssl too. I have fail2ban too so consider it enough security for if the user passwords are long enough. You can set minimum lengths if letting others use it, or in my case I helped family set it up and made them have strong passwords.

Like others have said, the apps cache everything locally. I have used it without issues with no mobile Internet (e.g. for my cc pin numbers I store on there when i was out in the country with crap reception). I guess you’re more likely to create accounts at home anyway but if you have to when out, it would sync whenever you have it back on the lan.