Why not go further and make it 'dark' or 'invisible' to the external network... thus its secure by default from external network attacks. As BunkerWeb is built on Nginx, this is relevant - https://blog.openziti.io/nginx-zerotrust-api-security
That's awesome, thanks for sharing. We will have a look at it for sure.