My personal project web server has done this for years with just some basic nginx configuration.

You only find my webpage if the SNI contains the host name. If you connect using the bare IP, it presents a self-signed certificate. If you accept it, it just returns a bare 404 Not Found.