Would it be helpful to create a "allowed hosts" configuration, like in nextcloud "trusted domains"?:
'trusted_domains' =>
[
'demo.example.org',
'otherdomain.example.org',
'10.111.112.113',
'[2001:db8::1]'
]
In curl (Or HTTP requests in general) you can put what ever you want in the host header/when the unix socket is used: