NGINX

How to keep your origin IP private and server protected from DOS attacks? My currently iteration of server setup is as follows: Cloudflare front with the origin server running NGINX as a reverse proxy (like cipher.tools) or delivering static HTML & content (like alexbarter.me).