Integrating Cloudflare when behind a cgnat

This is my first time posting on this forum and I feel I need to give you some background to my ability or lack of. I am 70 years old and started my home automation journey about 6 months ago when I bought 2 smart bulbs, what a journey it has been I had no technical knowledge whatsoever apart from being able to find my way round facebook and sites of interest.
I decided I wanted more control over my system so using an old laptop installed several flavours of linux running home assistant supervised and eventually settled on Debian Bullseye.
It has not been an easy journey at my age but until now I have tried to problem solve without asking for any assistance so please don’t think I haven’t tried as my old boss used to say “there’s no such thing as a stupid question” so here goes.
my set up
Huawei B818 bridged on Smarty internet (three)
Tplink Archer C80 bound to tp link ddns
Debian Bullseye operating system (latest version)
Home Assistant supervised (latest version)
Maria DB and nginx proxy manager.
I have a cheap lol domain name transferred to Cloudflare.
I have now made so many changes watched so many videos and read so many guides I am in information overload.
bellow are the logs for Maria Db and Nginx

Maria DB
[s6-init] making user provided files available at /var/run/s6/etc...exited 0. [s6-init] ensuring user provided files have correct perms...exited 0. [fix-attrs.d] applying ownership & permissions fixes... [fix-attrs.d] done. [cont-init.d] executing container initialization scripts... [cont-init.d] done. [services.d] starting services [services.d] done. [06:01:19] INFO: Using existing mariadb initial system [06:01:19] INFO: Starting MariaDB 220222 06:01:20 mysqld_safe Logging to '/data/databases/mariadb.err'. 220222 06:01:20 mysqld_safe Starting mysqld daemon with databases from /data/databases 220222 06:01:20 mysqld_safe Starting mysqld daemon with databases from /data/databases 2022-02-22 6:01:21 0 [Note] /usr/bin/mysqld (mysqld 10.4.19-MariaDB) starting as process 396 ... 2022-02-22 6:01:21 0 [Note] InnoDB: Using Linux native AIO 2022-02-22 6:01:21 0 [Note] InnoDB: Mutexes and rw_locks use GCC atomic builtins 2022-02-22 6:01:21 0 [Note] InnoDB: Uses event mutexes 2022-02-22 6:01:21 0 [Note] InnoDB: Compressed tables use zlib 1.2.11 2022-02-22 6:01:21 0 [Note] InnoDB: Number of pools: 1 2022-02-22 6:01:21 0 [Note] InnoDB: Using SSE2 crc32 instructions 2022-02-22 6:01:21 0 [Note] mysqld: O_TMPFILE is not supported on /var/tmp (disabling future attempts) 2022-02-22 6:01:22 0 [Note] InnoDB: Initializing buffer pool, total size = 128M, instances = 1, chunk size = 128M 2022-02-22 6:01:22 0 [Note] InnoDB: Completed initialization of buffer pool 2022-02-22 6:01:22 0 [Note] InnoDB: If the mysqld execution user is authorized, page cleaner thread priority can be changed. See the man page of setpriority(). 2022-02-22 6:01:23 0 [Note] InnoDB: 128 out of 128 rollback segments are active. 2022-02-22 6:01:23 0 [Note] InnoDB: Creating shared tablespace for temporary tables 2022-02-22 6:01:23 0 [Note] InnoDB: Setting file './ibtmp1' size to 12 MB. Physically writing the file full; Please wait ... 2022-02-22 6:01:23 0 [Note] InnoDB: File './ibtmp1' size is now 12 MB. 2022-02-22 6:01:23 0 [Note] InnoDB: Waiting for purge to start 2022-02-22 6:01:23 0 [Note] InnoDB: 10.4.19 started; log sequence number 40399621; transaction id 17422 2022-02-22 6:01:23 0 [Note] InnoDB: Loading buffer pool(s) from /data/databases/ib_buffer_pool 2022-02-22 6:01:23 0 [Note] Plugin 'FEEDBACK' is disabled. 2022-02-22 6:01:25 0 [Note] Server socket created on IP: '::'. 2022-02-22 6:01:30 0 [Note] Reading of all Master_info entries succeeded 2022-02-22 6:01:30 0 [Note] Added new Master_info '' to hash table 2022-02-22 6:01:30 0 [Note] /usr/bin/mysqld: ready for connections. Version: '10.4.19-MariaDB' socket: '/run/mysqld/mysqld.sock' port: 3306 MariaDB Server [06:01:31] INFO: Check data integrity and fix corruptions mysql.column_stats OK mysql.columns_priv OK mysql.db OK mysql.event OK mysql.func OK mysql.global_priv OK mysql.gtid_slave_pos OK mysql.help_category OK mysql.help_keyword OK mysql.help_relation OK mysql.help_topic OK mysql.index_stats OK mysql.innodb_index_stats OK mysql.innodb_table_stats OK mysql.plugin OK mysql.proc OK mysql.procs_priv OK mysql.proxies_priv OK mysql.roles_mapping OK mysql.servers OK mysql.table_stats OK mysql.tables_priv OK mysql.time_zone OK mysql.time_zone_leap_second OK mysql.time_zone_name OK mysql.time_zone_transition OK mysql.time_zone_transition_type OK mysql.transaction_registry OK homeassistant.events OK 2022-02-22 6:01:40 0 [Note] InnoDB: Buffer pool(s) load completed at 220222 6:01:40 homeassistant.recorder_runs OK homeassistant.schema_changes OK homeassistant.states OK homeassistant.statistics OK homeassistant.statistics_meta OK homeassistant.statistics_runs OK homeassistant.statistics_short_term OK nginxproxymanager.access_list OK nginxproxymanager.access_list_auth OK nginxproxymanager.access_list_client OK nginxproxymanager.audit_log OK nginxproxymanager.auth OK nginxproxymanager.certificate OK nginxproxymanager.dead_host OK nginxproxymanager.migrations OK nginxproxymanager.migrations_lock OK nginxproxymanager.proxy_host OK nginxproxymanager.redirection_host OK nginxproxymanager.setting OK nginxproxymanager.stream OK nginxproxymanager.user OK nginxproxymanager.user_permission OK [06:01:40] INFO: Ensuring internal database upgrades are performed This installation of MariaDB is already upgraded to 10.4.19-MariaDB, use --force if you still need to run mysql_upgrade [06:01:41] INFO: Ensure databases exists [06:01:41] INFO: Create database homeassistant [06:01:41] INFO: Ensure users exists and are updated [06:01:42] INFO: Update user homeassistant [06:01:42] INFO: Init/Update rights [06:01:42] INFO: Granting all privileges to homeassistant on homeassistant [06:01:44] INFO: Successfully send service information to Home Assistant.

Nginx
Add-on version: 0.11.0
You are running the latest version of this add-on.
System: Debian GNU/Linux 11 (bullseye) (amd64 / qemux86-64)
Home Assistant Core: 2022.2.9
Home Assistant Supervisor: 2022.01.1

Please, share the above information when looking for help
or support in, e.g., GitHub, forums or the Discord chat.

[cont-init.d] 00-banner.sh: exited 0.
[cont-init.d] 01-log-level.sh: executing…
[cont-init.d] 01-log-level.sh: exited 0.
[cont-init.d] mysql.sh: executing…
[cont-init.d] mysql.sh: exited 0.
[cont-init.d] nginx.sh: executing…
[cont-init.d] nginx.sh: exited 0.
[cont-init.d] npm.sh: executing…
[cont-init.d] npm.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[06:04:04] INFO: Starting the Manager…
[06:04:04] INFO: Starting NGinx…
2022/02/22 06:04:05 [error] 568#568: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 192.168.0.127, server: nginxproxymanager, request: “GET /api/ HTTP/1.1”, upstream: “http://127.xxx.xxx.xxx/”, host: “192.xxx.xxx.xxx”, referrer: “http://192.xxx.xxx.xxx:xzx/nginx/certificates”
[2/22/2022] [6:04:33 AM] [Migrate ] › :information_source: info Current database version: 20210210154703
[2/22/2022] [6:04:33 AM] [IP Ranges] › :information_source: info Fetching IP Ranges from online services…
[2/22/2022] [6:04:33 AM] [IP Ranges] › :information_source: info Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[2/22/2022] [6:04:34 AM] [IP Ranges] › :information_source: info Fetching https://www.cloudflare.com/ips-v4
[2/22/2022] [6:04:34 AM] [IP Ranges] › :information_source: info Fetching https://www.cloudflare.com/ips-v6
[2/22/2022] [6:04:35 AM] [SSL ] › :information_source: info Let’s Encrypt Renewal Timer initialized
[2/22/2022] [6:04:35 AM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [6:04:35 AM] [IP Ranges] › :information_source: info IP Ranges Renewal Timer initialized
[2/22/2022] [6:04:35 AM] [Global ] › :information_source: info Backend PID 540 listening on port 3000 …
QueryBuilder#allowEager method is deprecated. You should use allowGraph instead. allowEager method will be removed in 3.0
QueryBuilder#eager method is deprecated. You should use the withGraphFetched method instead. eager method will be removed in 3.0
QueryBuilder#omit is deprecated. This method will be removed in version 3.0
[2/22/2022] [6:04:52 AM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [6:04:52 AM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [7:04:35 AM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [7:04:37 AM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [7:04:37 AM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [8:04:35 AM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [8:04:37 AM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [8:04:37 AM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [9:04:35 AM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [9:04:38 AM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [9:04:38 AM] [SSL ] › :information_source: info Renew Complete
[22/Feb/2022:10:02:40 +0000] - 400 400 - GET http barsteward.online “/” [Client 192.xxx.xxx.xxx] [Length 16] [Gzip -] [Sent-to 192.168.0.130] “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36” “http://192.168.0.130:81/
[22/Feb/2022:10:02:41 +0000] - 400 400 - GET http barsteward.online “/favicon.ico” [Client 192.168.0.127] [Length 16] [Gzip -] [Sent-to 192.168.0.130] “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36” “http://barsteward.online/
[2/22/2022] [10:04:35 AM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [10:04:37 AM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [10:04:37 AM] [SSL ] › :information_source: info Renew Complete
[22/Feb/2022:10:09:51 +0000] - 400 400 - GET http barsteward.online “/” [Client 192.xxx.xxx.xxx] [Length 16] [Gzip -] [Sent-to 192.168.0.130] “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36” “http://192.xxx.xxx.xxx./”
[22/Feb/2022:10:09:51 +0000] - 400 400 - GET http barsteward.online “/favicon.ico” [Client 192.168.0.127] [Length 16] [Gzip -] [Sent-to 192.168.0.130] “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36” “http://barsteward.online/
[2/22/2022] [11:04:35 AM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [11:04:38 AM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [11:04:38 AM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [12:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [12:04:35 PM] [IP Ranges] › :information_source: info Fetching IP Ranges from online services…
[2/22/2022] [12:04:35 PM] [IP Ranges] › :information_source: info Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[2/22/2022] [12:04:36 PM] [IP Ranges] › :information_source: info Fetching https://www.cloudflare.com/ips-v4
[2/22/2022] [12:04:36 PM] [IP Ranges] › :information_source: info Fetching https://www.cloudflare.com/ips-v6
[2/22/2022] [12:04:37 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [12:04:39 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [12:04:39 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [1:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [1:04:38 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [1:04:38 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [2:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [2:04:38 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [2:04:38 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [3:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [3:04:38 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [3:04:38 PM] [SSL ] › :information_source: info Renew Complete
Duplicate relation “access_list” in a relation expression. You should use “a.[b, c]” instead of “[a.b, a.c]”. This will cause an error in objection 2.0
[2/22/2022] [3:18:15 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [4:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [4:04:38 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [4:04:38 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [5:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [5:04:38 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [5:04:38 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [6:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [6:04:35 PM] [IP Ranges] › :information_source: info Fetching IP Ranges from online services…
[2/22/2022] [6:04:35 PM] [IP Ranges] › :information_source: info Fetching https://ip-ranges.amazonaws.com/ip-ranges.json
[2/22/2022] [6:04:36 PM] [IP Ranges] › :information_source: info Fetching https://www.cloudflare.com/ips-v4
[2/22/2022] [6:04:36 PM] [IP Ranges] › :information_source: info Fetching https://www.cloudflare.com/ips-v6
[2/22/2022] [6:04:36 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [6:04:36 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [6:04:36 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [7:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [7:04:36 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [7:04:36 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [8:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [8:04:36 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [8:04:36 PM] [SSL ] › :information_source: info Renew Complete
[2/22/2022] [9:04:35 PM] [SSL ] › :information_source: info Renewing SSL certs close to expiry…
[2/22/2022] [9:04:36 PM] [Nginx ] › :information_source: info Reloading Nginx
[2/22/2022] [9:04:36 PM] [SSL ] › :information_source: info Renew Complete`

I know it’s a big ask for people to give up their own leisure time to help others and some might say I should go down the road of Nabu Casa but I’m just not built that way and my brain will completely vegetate if I don’t try.

If some one could give me Numties Guide to sorting this config out I would very much appreciate it.

It may also help anyone else having difficulties, surely I can’t be the only one, can I!
Thanks in advance Barsteward