Simple. Set up another webserver. Can be behind firewall, on http traffic.
Use your own web exposed nginx server to serve content from it:
location /proxy/ {
proxy_pass http://ip.of.your.server/site;
}
Suddenly, if you mess things up a little bit, you’ll see in the logs (of course, of the web-hidden server), that you’re getting requests for /proxy/[subpath]
fix the upper “location” part so it points to ^~ /proxy/
then, don’t forget to service nginx restart
the hell out of it. ;-)