Barring any Traefik tricks that allows me to accomplish what I’m after, I was thinking of going with your “third” option of just letting it use Cloudflare for everything but, I had to check with the experts first before just doing it.

I have some apps that complain or, in one case, flat out doesn’t work if the cert is invalid. I’ve been working around it (sort of) but it would be nice to have it set up “correctly” for once. If routing all traffic through Cloudflare is the answer, so be it ¯_(ツ)_/¯