I custom-build the Caddy container since it is easy to do with xcaddy. It is automated to run every week via Forgejo Actions on a Forgejo repo, and one can pull the latest images from there using Portainer or whatever docker updater software there is.

You can also use any other CI/CD solutions you like as long as it churn out a regularly updated image. Github Actions is another good one if you don’t wanna set up Forgejo.

The caddy-cloudflare image is probably also enough for your use case, assuming they’re regularly updated and has no vulnerabilities. But if you like control, CI is one way to go.