This is basically my config:

wireguard:
    container_name: wireguard
    image: weejewel/wg-easy
    volumes:
      - ./data/wiregaurd:/etc/wireguard
    environment:
      - WG_DEFAULT_DNS=192.168.10.3
      - WG_HOST=public.example.com
    env_file:
      - ./env/wg-easy.secrets
    ports:
      - 51820:51820/udp
      - 51820:51820/tcp
    expose:
      - 51821
    restart: always
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    depends_on:
      - pihole
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

In my case, I reverse proxy port 51821 through caddy to configure clients (with Authelia in front of it), but you could expose it interally only if you want to prevent that interface from being publicly accessible.

Note that public.example.com needs to be replaced with your connection's public dns hostname (you can use something like duckdns for this if you want), and that you need to expose 51820 on your firewall/router. In my example above, 192.168.10.3 is the IP for pihole, and resolves some internal hostnames. You should look over the config provided once you set up a client and make sure it uses accessible hostnames, etc.

I don't think there's any specific reason to worry about using cloudflare tunnels over any other VPN solution, and if your connection uses NATCG, you might actually need something that tunnels out to a central hub.