linuxserver.io has a reverse proxy container called SWAG that integrates fail2ban with an Nginx reverse proxy. You could set that container up as a proxy to your other containers, then point your Cloudflare tunnel to the reverse proxy. I'm in the middle of setting this up on my own homelab, so feel free to reach out if you have any questions.
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists