There is a bit lack of information:
- would be server(nginx/apache/etc) dedicated for vpn client serving or global/vpn(server should be available globally in the internet)?
- topology sample of the network, your sever and clients sample
I assuming that you have some set of clients which have access to vpn dedicated network with some resources inside and you will add there new internal-only service.
For vpn clients only: you could up http server for the listen only on vpn interface and that's it, nothing more is required.
For serving global/vpn: you should decide which endpoints should be accessible only from vpn network and allow them, using access module of your http server by network mask
Please note, that in all cases your instance should have access to your vpn network