Rather than exposing Calibre through your router, or any other services, you might want to stand up a reverse proxy such as
Nginx Proxy Manager or
Traefik.
You would then configure your router to forward external requests on port 443 and port 80 to the server containing the reverse proxy container. The reverse proxy has configuration to forward "calibre.[your domain.tld]" to the container on 192.168.25.20:7080.