One other important detail is also to have the basement server route through the VPS (via the WireGuard tunnel) for any outbound internet connections as well, especially in the case of federation, or sending email (many mailservers will include the client IP that an email originated from). This is a big detail that many folks overlook when doing a basement fedi server behind Cloudflare, because the actual server IP can be exposed in any server-to-server traffic, if it doesn't route through somewhere else first.