I ended up closing ports 5432 and my application's 20000 and figuring everything out in nginx. Never thought I would have 70 ms response times on a $4/ month server!
It involved a lot of googling and bouncing ideas off friends, but here are some resources that helped me:
Don't use this first one, it's self-signed. But it's a good intro to the world of HTTPS.
https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04
I took the first two parts of this.
https://sanic.dev/en/guide/deployment/nginx.html#nginx-configuration
This guide showed me how to ufw allow nginx
https://haydenjames.io/how-to-set-up-an-nginx-certbot/
And this one brought it all together, with running certbot as sudo, under LetsEncrypt, and registering it to auto-renew as a cron job.
https://www.nginx.com/blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx