I’ve tried using proxy protection with cloudflare, but it breaks access to the site and just about every external replication service. Maybe something about pointing a proxy at a proxy? You still get telemetry, so you’d likely still go down without that protection, but at least you get reports in the cloudflare console about what ips to blackhole in your firewall.

YMMV