After the posts from @Lewis and @final_blueberry, I finally got stuck into getting my version of Cloudflare working for Home Assistant, Frigate, Immich, and all of my self-hosted things. Instead of some of the methods used in this thread and others, I took parts from each and then added some extra myself.
Now I have my services ie. sub.domain.com protected by email login code but if you are in the ‘safe ip’ or whitelist, then you skip that all together. This is achieved by CF Zero Trust, Cloudflare tunnel, IP list via iOS shortcut.
I have created my own post