Sorry, I mixed my thoughts about a possible solution where a bunker is hosted in an app and you use something like ngrok or tailscale to proxy back to the app.
Your proposal is actually better!