Just to add, to avoid connecting via HTTP outside the VPN by accident, you can set the firewall/docker to accept connections into that port only through the VPN’s ip address