Use UFW to allow all and only Cloudflare IPs access to 443.

Cloudflare UFW

# Are you using Cloudflare to protect your web server? Don't allow
# just _any_ system to connect to your server! Only CF systems should 
# be allowed to connect to your server.
#
# From that "allow https" rule, and use these commands instead to add
# limit access to CF IPs!

# Last updated July 8th, 2020

# IPv4
sudo ufw allow from 173.245.48.0/20 to any port 443 proto tcp
sudo ufw allow from 103.21.244.0/22 to any port 443 proto tcp
sudo ufw allow from 103.22.200.0/22 to any port 443 proto tcp
sudo ufw allow from 103.31.4.0/22 to any port 443 proto tcp
sudo ufw allow from 141.101.64.0/18 to any port 443 proto tcp
sudo ufw allow from 108.162.192.0/18 to any port 443 proto tcp
sudo ufw allow from 190.93.240.0/20 to any port 443 proto tcp
sudo ufw allow from 188.114.96.0/20 to any port 443 proto tcp
sudo ufw allow from 197.234.240.0/22 to any port 443 proto tcp
sudo ufw allow from 198.41.128.0/17 to any port 443 proto tcp
sudo ufw allow from 162.158.0.0/15 to any port 443 proto tcp
sudo ufw allow from 104.16.0.0/12 to any port 443 proto tcp
sudo ufw allow from 172.64.0.0/13 to any port 443 proto tcp
sudo ufw allow from 131.0.72.0/22 to any port 443 proto tcp

# IPv6
sudo ufw allow from 2400:cb00::/32 to any port 443 proto tcp
sudo ufw allow from 2606:4700::/32 to any port 443 proto tcp
sudo ufw allow from 2803:f800::/32 to any port 443 proto tcp
sudo ufw allow from 2405:b500::/32 to any port 443 proto tcp
sudo ufw allow from 2405:8100::/32 to any port 443 proto tcp
sudo ufw allow from 2a06:98c0::/29 to any port 443 proto tcp
sudo ufw allow from 2c0f:f248::/32 to any port 443 proto tcp