I can't tell you how to implement one from scratch if that's your question, but I use apache httpd with mod_fcgi.
This server isn't directly exposed, only valid requests are proxied to it.
I have no reason to think this is the best approach, it's a near forgotten foundational layer of an application that has been stable and reliable for a decade, that is under constant attack and regularly pen-tested.
Or if you're running PHP, this shortcut usually does the right thing: https://caddyserver.com/docs/caddyfile/directives/php_fastcg...