Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. With Tunnel, you do not send traffic to an external IP — instead, a lightweight daemon in your infrastructure (cloudflared) creates outbound-only connections to Cloudflare’s global network. Cloudflare Tunnel can connect HTTP web servers, SSH servers, remote desktops, and other protocols safely to Cloudflare. This way, your origins can serve traffic through Cloudflare without being vulnerable to attacks that bypass Cloudflare.
https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
This probably the most critical part of self hosting and the most important. It allows you to securely connect to your services behind cloudflare. I’m sure a network admin would scoff at that last statement but for my RSS reader, for example, I’ve found this service to work great.
Cloudflare manages all of my domain names and therefore DNS. Then, for anything I want access to from an outside network I create an access rule that basically stops anyone without my email address from accessing my site. I’ve also turned off visits from Russia, and for my sensitive applications China and Philippines.
Here’s a good tutorial that’ll explain everything better than I ever will:
How I set up my Unraid home server with Cloudflare to allow secure remote access
https://www.nadeau.io/post/unraid-home-server-with-cloudflare/