Reverse proxy

Keep the Docker port on 127.0.0.1:2499 and let a reverse proxy on the same machine handle HTTPS termination.

Simplified Nginx example:

server {
    listen 443 ssl;
    server_name vidarch.example.com;

    location / {
        proxy_pass http://127.0.0.1:2499;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_buffering off;
    }
}

proxy_buffering off supports live progress events. For large media, adjust your proxy timeouts and limits without removing security controls.

Enable a valid certificate, a VidArch password, and network restrictions. Test the connection, video seeking playback, and download events from the final address.