this is awesome!

Thanks for setting this template up!

I think the SSL mode on cloudflare needs to be set to Full (Strict) though.

Indeed it does, please check out the overview for full instructions

A suggestion:

Document that some services (like SvelteKit) start with host 0.0.0.0, that would make the Tunnel to fail. My fix was, on my service variables, create a HOSTNAME variable (which is the same as my internal URL) and, on my Docker image, run with that host.

E.g.
Internal URL: myapp.railway.internal
VAR: HOSTNAME: myapp
Dockerfile: HOST=$HOSTNAME node index.js