You need to bind to at least the wireguard interface/address in order for this to work. The service reverse proxies over the tunnel, and your kernel won’t be looking to handle those connections unless you’re listening on the correct tunnel interface.