You can use Cloudflare without the tunnel too, then it’s just a reverse proxy.

2a01:4ff:1f0:c2f8::/64 is the whole subnet, your server will have one (or more) addresses in that subnet. This could be 2a01:4ff:1f0:c2f8::1, but could also be a randomly generated suffix.

However, I’d prefere not to open ports at home

But why? Opening one incoming port is not an issue if you only allow connections from the VPS in the firewall on that port. Keeping a 24/7 tunnel up is certainly possible, but it adds another layer of complexity/reliability.

Because hosting commercially with large (multi-TB) storage gets very expensive very quickly

.local is mDNS - and I’m using that, saves me so much hassle with split-horizon issues etc.

I also use global DNS for local servers (AAAA records on my own domain), again, this eliminates split-horizon issues. Life is too short to deal with the hassle of running your own DNS server.