Use repnotify when you need to be notified, ie health changes on a UI
you can use replicated when changes dont need to be shown, ie maybe movement speed.
damage should always be done on server but you could RPC back say a damage number popup. this is better than a repnotify because its a one shot, ie if a client joins late they dont need to see previous damage.
and of course you need client to server RPC for player input, so the player can input a fire command and the server runs the damage event if valid