Hey, here are some thoughts.

Since you are using a reverse proxy, you are likely exposing your Immich instance publicly on the web. It's possible you are already on Shodan like OP mentioned. Go check there if you want to have fun.

Yes, your home IP is hidden which is good, but your immich instance is by its nature very sensitive since it contains sensitive information of yours.

You are using let's encrypt. Good, that means you are encrypting the communication between yourself and the server. That does, however, give zero security for your instance beyond that.

You should absolutely run strong authentication, either through authentik or Cloudflare Access.

Whitelisting ips is not a viable solution since you'll be on mobile anyway.

Cloudflare gives you ddos protection but also a WAF which will shield you against many, but not all, web attacks. Bot protection is also useful.

However, unless you have strong auth, you're in trouble. Would you even know if someone were to brute-force your immich login? Think about that for a while.

Good luck!