Simple. Set up another webserver. Can be behind firewall, on http traffic.

Use your own web exposed nginx server to serve content from it:

location /proxy/ {
    proxy_pass http://ip.of.your.server/site;
}

Suddenly, if you mess things up a little bit, you’ll see in the logs (of course, of the web-hidden server), that you’re getting requests for /proxy/[subpath]

fix the upper “location” part so it points to ^~ /proxy/

then, don’t forget to service nginx restart the hell out of it. ;-)