You can safely use the Cloudflare proxy after installation completes. Let’s Encrypt doesn’t like it initially, but it uses a different method to renew than enrol.
There is a Cloudflare template which needs adding to the app.yml to get the correct source IPs.