Download the certs from cloudflare dashboard and using trellis’ manual provider is your best solution.
Cloudflare SSL doesn’t suffer from the LE proxy problem. You can select how long does the cert (the ones you download) valid for. See: Origin CA certificates · Cloudflare SSL/TLS docs