Thanks.
The problem I thought I had to solve I thought was caused by SSL issue with CF moving from flexible to Full of Full-Strict after proxing through CF (historically grey cloud).
It wasn’t that problem in the end, there was a legacy page rule that was causing super redirect loop, which is suggested can be caused by incorrect SSL setup in CF as per the guide on meta, but in this case it was the pesky page rule.
Very easy fix that one, but a bit slow to figure out! 
However to the ancillary issue.
I assume that when placing the keys, certs it’s all done in the container side for CF Full [strict] the cert and key need to be placed container side. The .conf type mods in the app.yml in.
This is my own lack of technical orientation. Dockers or the continuer is like a kinder egg right? Linux the chocolate egg and docker is the cool toy (already assembled) inside.
Finally, the discourse install had letsencrypt and FULL appears to be working fine with this and HTTPS works and this is now allowing traffic mitigation actions.