This is a case of RTFM. Specifically, TFM says:

Please note that we do not support nor encourage the use of reverse proxies and container to run Headscale.

Notwithstanding the above, there is community documentation to run headscale behind conventional reverse proxies.

However, per the headscale discord, cloudflare does not work because tailscale/headscale utilize a non-standard websocket negotiation.

If you want an alternative to headscale without publicly exposing your home IP too much, I highly recommend trying something like innernet.

What I like about innernet is that the control interface is only exposed within the VPN network, so there is no big deal that your IP is internet-facing — all non-WG connections to the open WG port are dropped, and WG connections require authentication.