You can use OTPClient on desktop, it can import Aegis encrypted exports.

It's what I do, my TOTP codes originate on the phone because I scan the QR codes with it, but Aegis is set to export a backup each time something changes.

A sync app (FolderSync) runs every night and gets the export to my server, where it gets picked up for offline backups.

I load the latest export in OTPClient only as needed, when I run into a 2fa which is not there.

Both Aegis and OTPClient can be set to ask for password each time you open them.

This is the way.

The bitwarden clients themselves do keep a cached version of the database every time there is a successful sync to the server, so if you were to take the server offline you could still view / export the data thankfully! You cannot make changes to the database according to that page and my own experience, though others have reported that they are able to. Additionally, it looks like this cache does expire (30 days on desktop, 90 on mobile).

Just make sure to not log out completely (this is not the same as locking the vault, which is fine), this wipes the cache immediately.

Losing things is one of the risks of any setup. With paid for services you are putting trust that the provider has put in place methods to prevent downtime/data loss. Self-hosting means the onus is on you. Make sure you document things, make sure you have some kind of backup in place, and update things regularly (but maybe not straight away, just in case).

Also expect to occasionally run into weird issues that you need to figure out a fix for. I am 99% sure it was for my NextCloud-AIO setup a year or so ago, but there was an update to it that broke the setup if you had created the containers previousy at a certian time. You needed to run a particular command inside one of the containers to fix it up.

There was also the time where I migrated things off a physical server to a VM, but missed the script that was doing my certbot DNS challenge renewal. I had not documented things back then and a few months later all my services stopped working, that took a bit to re-do.

I do make sure to keep backups of my VM's, and for the VPS I run I pay a bit extra for vultr to keep backups/snapshots there. Along with actual documentation of how I did the setup, I've got things stable for the most part.

Here's my Heimdall homepage to give an example of different services I run, as well as some links to other websites. Blanked out a few things for privacy and eyepatch reasons (not sure if that's allowed here).

Then I guess use a hardware key for Bitwarden and 2FA (saved in Bitwarden) for the websites that don't support it. Or bitwarden could implement something like 1Password's second password mechanism. That would most likely solve tge 2FA issue.

Yeah, I use Yubikeys for my password manager 2FA and keep all other OTP seeds with their respective creds in Bitwarden

That is true. But that'd be the case for any online/cloud 2FA service. So you could either have a local 2FA app just for Bitwarden or set up less secure but more convenient email 2FA.

The first part, yes it does. Though I never use it and manually edit it. The second part, no idea tbh.

Email, sms, mfa from another bitwarden logged in, and my yubikey

While that is true, there have been many discussions about if there are any known security vulnerabilities or new spec changes that would cause a problem. The consensus from the community is that it is safe to use for quite some time. Not invalidating your points in any way just putting out what I know.