apt/yum/dnf install nginx, listen on public IP of VPS, use proxy_pass to forward to your internal IP

server {
    listen [::]:443 ssl;
    http2 on;
    server_name service.example.com;
    root /var/data/websites/holding;
    index index.php index.html index.htm;

    #SSL setting
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    add_header X-Clacks-Overhead "GNU Terry Pratchett";
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # access_log /var/log/nginx/service-access.log main;
    access_log off;

    location / {
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header X-Forwarded-Proto "https";
      proxy_set_header X-SECURE-REQUEST "true";
      proxy_set_header Host $http_host;
      proxy_pass http://192.168.1.2/; #IP of the service over the VPN
    }

}