default reverse proxy ngnix

subdomain.doamin.TLD

server {
        listen 80;
        listen [::]:80;

        root /var/www/subdomain.doamin.TLD/html;
        index index.html index.htm index.nginx-debian.html;

        server_name subdomain.doamin.TLD;
        return 302 https://$server_name$request_uri;
}
server {

    # SSL configuration

    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ssl_certificate         /etc/ssl/cert1.pem;
    ssl_certificate_key     /etc/ssl/key1.pem;

    server_name subdomain.doamin.TLD;

    location /  {
                proxy_pass    http://localhost:9696;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;
        }
}

Use cloudflare strict policy and generate origin keys