I really do not think anyone should trust a vibe coded repo that launched 1 minute ago as a viable defense for any service.
You're right, you should just leave your PHP totally unprotected.
I would recommend running this binary as a user that has no access to any files, it can just proxy traffic through a port. I will put that in the README.
Yes, you should vibe-code your own instead.
(Not even joking, if you're going to go hog go whole-hog.)