This page says (at the very bottom):

Tailscale can route its packets peer-to-peer over IPv4 or IPv6, with and without NAT, multi-layer NAT, or CGNAT in the path.

You’re already using cloudflare, so check out cloudflare tunnels. You install their software on your server which makes an outbound connection, bypassing the need for open ports or a public IP. Note this only does http traffic.

Another option is tail scale, which won’t make your site public but will let you access it remotely on devices you have their software/app on.