There are some tools to help, but things are sort of specific to particular aspects. Lynis for general systems, ntopng for networks, and such.
For 90% of stuff, though, you can just stick to stable repos and upgrade on a schedule and you'll be alright.
What's a good reverse proxy for a set up using Cloudflare?
Having a reverse proxy behind your reverse proxy is a little redundant, but should work fine. My preference after trying several was nginx. The config takes a little to get used to, but it has a ton of features.
is Cloudflare's proxy really needed?
Not at all.
Cloudflare just makes configuration a bit easier, especially if you're behind CGNAT. I wrote a little about them here: https://blog.k3can.us/index.php?post/2025/02/Cloudflare-for-the-Selfhoster
Nerd blogs, a couple message boards and Reddit subs, and XKCD, of course.