Yes, the CNAME record via Cloudflare does not leave a lot to the imagination as to what app it is pointing to, but I have not opened port 80 or 443 on my firewall, so the firewall is bouncing any probes.

That is almost exactly what I would like to do, but with Plex/Overseerr. I am curious, do you run any type of intrusion detection s/w, or have you set up fail2ban?