But since you don’t actually need to multi-plex HTTP with XMPP, why not just configure port forwarding like you would do in a local network (assuming your VPS is connected to your Rasberry via a Wireguard VPN or similar)?
For the certs you can request them again from your Rasberry easily if you use the DNS-01 method. That also allows you to get wildcard certs, which are very useful with the multiple subdomains you usually have for a XMPP service.