Yeah, that’s also my use case - the application connects to my matrix.org service, instead of exposing any ports. In fact I’d rather not open any ports.
If you’re only doing internal traffic via app-name.internal, you can remove the [[services]] and [http_service] section.
If you’re doing internal traffic via app-name.flycast (read more about Flycast here), you need to specify a port, but you can release your public IP to make your app private (fly ips release).
I put a fake port in the config and it worked. I guess a better solution is to do what @ben-io is suggesting. Thanks for your help and for maintaining this great service.