I can't tell you how to implement one from scratch if that's your question, but I use apache httpd with mod_fcgi.

This server isn't directly exposed, only valid requests are proxied to it.

I have no reason to think this is the best approach, it's a near forgotten foundational layer of an application that has been stable and reliable for a decade, that is under constant attack and regularly pen-tested.