How to set up a test environment that's not public-Internet facing?

[bendilts]

I've spent several hours trying to figure out how to deploy my application to a test environment that's not publicly-accessible. I've tried so many different combinations it's hard to remember all of them, but basically I'm trying to do this:

• Manually create a VPC with 2 private and 2 public subnets from the AWS console
• Manually create an EC2 instance in one of the public subnets and install a VPN server on it that can route traffic through to the private subnets
• copilot env init, name the environment "test", choose the VPC and only the private subnets
• In my "Load Balanced Web Service", add something to environments.test, maybe network:vpc:placement:private?
• copilot svc deploy, which fails for a variety of reasons depending on the details of my attempt

Is there some kind of walkthrough somewhere for how to get a functional private environment for testing?