Great 👍🏻

This is, what I was looking for.

I solved this with two reverse proxies, bit exposed only the LNBits instance. This seems to be enough. LND is still hidden behind Tor, LNBits is reachable in clearnet via the VPSs IP.