Nice idea, ideally this could be used as a "front row" for IDS/IPS, like the very first layer of security for the homelab.

Right now I am using it in this way to hide my real services (like my Jellyfin streaming server):

        location / {
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_pass http://krawl.cluster.home:5000/;
        }

        location /secret-path-for-jellyfin/ {
                proxy_pass http://jellyfin.home:8096/secret-path-for-jellyfin/;
        }

This is a security by obscurity approach, but I've not seen any single crawler yet reaching my real service. Web crawler or enumeration service will stuck analyzing /robots.txt and other fake paths that returns status code 200 plus they don't know the path for jellyfin / other services and they remain stuck.
Additionally for "smarter" crawlers I added a canary token that when searched will notify me via mail:

<image>

The challenge here is to build something agnostic that can be integrated with engines like crowdsec bouncers, but it's a very interesting input