The IP ranges listed for whitelisting under https://Cloudflare.com/ips/ are fairly broad and include potentially millions of IPs.
I’m wondering if there’s a more specific list of server-facing IPs, or just would like to confirm that the listing given is entirely controlled by Cloudflare.
Those are entirely controlled by Cloudflare. They aren’t required to be whitelisted if you aren’t blocking everything but Cloudflare, but if you are then that’s the set of IPs. They aren’t all in use today, but those are our allocated ranges and as we expand POPs more get pressed into service.