Why not go further and make it 'dark' or 'invisible' to the external network... thus its secure by default from external network attacks. As BunkerWeb is built on Nginx, this is relevant - https://blog.openziti.io/nginx-zerotrust-api-security