Cloudflare tips

Websites behind Cloudflare

Real visitor IPs: when a site goes through the Cloudflare proxy, the web server's access log only shows Cloudflare's addresses. Configure Apache mod_remoteip or Nginx real_ip on the origin for the Cloudflare ranges, so the logs, and the Traffic page, show the real visitors. Until then, those requests are marked "Via Cloudflare".
Blocking: the server's firewall sees the connection coming from Cloudflare, not from the visitor, so blocking a visitor's IP on the server has no effect for proxied sites. Block such visitors in Cloudflare instead.
Cloudflare's ranges can never be blocked in 3R Monitor: that would make your sites unreachable for every visitor who comes through Cloudflare.
Monitors that check a site through Cloudflare may get a 403 from a Cloudflare challenge; the monitor reports it as such. Allow the master's IP in your Cloudflare security rules (for example an IP Access Rule or a WAF custom rule that skips the challenge).

With trust_proxy = auto (the default in master.conf), the master takes the real client IP from requests forwarded by Cloudflare, by the local machine or by the local network. Sign-in limits and the "allow IPs that signed in" rule then work with the real IP.
Let's Encrypt with --https: set the DNS record to DNS only while the certificate is issued, then turn the proxy back on.
Cloudflare Origin Certificate: free. Set the SSL/TLS mode to Full (strict), and serve it with tls_cert / tls_key on a port Cloudflare proxies (443, 2053, 2083, 2087, 2096 or 8443). See HTTPS, option 2.
Agents can keep reporting to the master's direct http://IP:8899 address, or use the Cloudflare address. A Cloudflare Origin Certificate is only trusted by Cloudflare, so agents that connect directly to an HTTPS port with it need insecure = true.