Can you add a configuration option for a secondary port. to the service config-sync?

It is possible to change the listening port on the HTTPS API, but not on the config-sync.

Right now - if you use a non 443 port for the HTTPS API listening port, you cannot use config-sync

Something like this:

vyos@hvi-fw-p# set service config-sync secondary 
Possible completions:
   address              IP address
   key                  HTTP API key
   timeout              Connection API timeout (default: 60)
   port                 External HTTP API Port (default: 443)