pfSense: Let's Encrypt certificate with ACME and Cloudflare DNS, then using it in HAProxy
Cloudflare token with Zone:Read + DNS:Edit on the zone, DNS-Cloudflare method with Token/Account ID/Zone ID, staging first, and a ‘Restart Local Service: haproxy’ action on the certificate so HAProxy reloads the new cert.