Gazi
Should I put my API server behind a Cloudflare Tunnel and close port 443 to the internet?
The tunnel is sound but makes Cloudflare your only way in; stay on the current Caddy setup, lock the origin to Cloudflare's IP ranges and add origin pulls.