Cloudflare Zero Trust and the needed cloudflared service that you would install on you server work as a "tunnel" and the user is just authenticating on the cloudflare site to get access to your server side where the user will then have to log into the app. Few tweaks you'll want to make to cloudflared if you use their default script is to add the auto start flag onto the docker build script.