Your app should parse the X-Forwarded-For header and allow only clients from trusted reverse proxies (a WAF is a reverse proxy). Most application frameworks should allow you to do that with minimal added code and you shouldn’t need yet another reverse proxy in front.
DDoS is not a direct concern (for you) since Fly Proxy terminates the TCP connections, so any DDoS traffic is going to hit Fly Proxy first. If they do not establish a real TCP connection, then that attack ends at us, not your machines; if it does establish real TCP connections (which will be a much more expensive attack and unlikely to overwhelm Fly Proxy or your app), then a policy that only allows trusted reverse proxies should block those connections as well.
We do have plans to eventually support the ability for you to “program” the proxy to only accept connections that match a certain pattern, but no ETA on that yet 