Using the sample file I provided above, comment out the lines about exposed ports (since this server is shared they will already be busy). After that add this line to the template list on the top:
- "templates/web.socketed.template.yml"
Now, after a rebuild Discourse will be listening only on a Unix socket under the shared folder. Point your reverse proxy to that.