Could you shell out for a decent firewall? It should be able to protect against majority of ddos attacks unless someone is paying for something big.

But it really is fine to use cloudflare if you want the ddos protection. I wouldnt feel bad at all.