In my most recent setup I created two VMs, one with just 80/443 -> HAProxy open and a second with only openvpn open. It should be more common practice, and offered by default from more providers, but unfortunately for now, you still have to set it all up yourself: