Apart from Dokku, there’s coolify and caprover.

Cloudflare tunnel only requires outbound port opened, check if you’ve allowed all outbound ports in EC2 security group (the default VPC should have this already).

Otherwise it’s probably a misconfiguration reaching the IP/port of the cloudflared service on the EC2. Have you tried checking cloudflared logs? Does your tunnel status show up as healthy?