My personal project web server has done this for years with just some basic nginx configuration.

You only find my webpage if the SNI contains the host name. If you connect using the bare IP, it presents a self-signed certificate. If you accept it, it just returns a bare 404 Not Found.

If applicable you could even use wildcard certificates to avoid having your subdomains domains showing in CT logs.

> Your NetScaler talks to strangers

talk to your servers about stranger danger.