I would say this would be the proper way to do it (at least as a sysadmin), but since it's OP's first time I would simplify it to:
- Install CloudFlare ZeroTrust daemon on your local server;
- Set up reverse proxy such as Nginx (optional, the alternative is to use a different subdomain for each service, which might be easier);
- Point the FQDN to CloudFlare.
Let CloudFlare handle the certificates, DDoS protection, etc... Link if you'd like to give this setup a try.
Yeah, I'm afraid you have to use a reverse proxy to host multiple subdomains. The CloudFlare daemon is the reverse proxy.