Selfhosted

Serious limits on Cloudflare Tunnels:

1. Only works if you use Cloudflare as your domain registrar for that domain
2. You can't use it for anything high bandwidth, specifically including streaming media (e.g. Plex/Jellyfin)
3. They reserve the right to terminate your service tunnel randomly at any time without warning for any/no reason unless you pay them for the service.

And that doesnt address the issue of getting in bed with Cloudflare (which has its own ethical ramifications).

I'd recommend one of the alternatives like localxpose.io that offer the same thing but without the limitations. Or you can slap together your own with a wireguard tunnel to a minuscule VPS with some routing rules on it. Both are about €5/month, which is cheaper (the same?) as paying for Cloudflare Tunnel to avoid the random termination and vendor lock in.

I love it, but I'm also a hypocrite. Centralized internet is bad but cloudflared is incredible.

The service is ok, but if you (rightfully) do not want to be tied to Cloudflare, take a look at Tailscale Funnels. Same concept, but from a company that values the user and their privacy. Also, for regular personal/small user base, free tier is more than enough. And you get a free .ts.net subdomain to use with your apps, if you need that.

I used a cloudflare tunnel for streaming music in jellyfin. Didn't so much else with it and it worked pretty well. Anything high bandwidth you should use something else, but for stuff that doesnt consume a ton of bandwidth like music streaming in my case, it worked fine, at least when I used it a few years back.

I'm using Pangolin, which is the current hotness. It's somewhat like cloud flare tunnels, but you need a VPS (find a cheap one). That tunnels back to your house. I opted into using crowdsec as another later. It's a part of their setup process.

Pangolin is also pretty straight forward. I set it up a few months ago to test out on a new server I was firing up and I've decided to just switch all my other servers running nginx-proxy-manager over to it.

Also, if you're just accessing it yourself and have maybe a handful of people who'd be using it, I'd recommend just setting up Headscale.

TLDR: Pangolin or Nginx-Proxy-Manager or Tailscale + one of the previously mentioned reverse proxy solutions.

I run a jellyfin server. I have gigabit fiber in ohio, USA. Some of my users found it basically unusable when they were geographicly far away, like Hawaii and Thailand. I switched to using cloudflare tunnel as an experiment and the difference was dramatic. They are now able to stream reliably almost as if they were geographically nearby. The fact of the matter is, the cloud flare CDN that's traffic passes through using the tunnel is infinitely better connected to the rest of the world than whatever home ISP you have.

That being said, cloudflare plays man in the middle to all your traffic, so I wouldn't use it for anything that's particularly secret. But for standard web pages it's amazing. I run my vaultwarden server directly on my home ip address and not through cloudflare tunnel.

It's easy to use and takes away some of the hassle.

If you don't like cloudflare you could find a VPS you do like and run Pangolin on it to get the same service but maybe not the same level of protection.

I use Oracle's free tier to host it. They're probably worse than cloudflare as far as evil corporations go though.

Cloudflare is very popular, there should be plenty people around with experience. And Cloudflare is convenient and fairly easy to use. I wouldn't call them "secure" though. I mean that depends on your definition of the word... But they terminate the encryption for you and handle certificates, so it's practically a man-in-the-middle, as they process your data transfers in cleartext. But as far as I know their track-record is fine. I have some ethical issues because they centralize the internet and some of their stuff borders on snake-oil... But it's a common solution if you can't open ports in your home internet connection, need some caching in front of your services, something to block AI scrapers, or you need a web application firewall as a service.

I just started using them and I like it. It’s a good balance of easy and secure for me. I just added the container to my stack and then use their UI to point a subdomain at the internal port. Security can go pretty extreme if you set up their whole zero trust thing.

An alternative similar option is Pangolin. I’ve seen a lot of people like it to avoid Cloudflare, but I haven’t used it myself. There still has to be an endpoint running it, so you’ll need an external VPS, which then adds a cost to the equation but at least you control it.

Does your use case include random people on the internet accessing these services or is it just for you? If it’s just you and a couple friends and their devices look into Headscale

What is the advantage of using a tunnel vs dynamic DNS directly to your home IP address?

I switched to it because the ISP blocked ports 80/443. It was good and things actually got a bit faster with them handling SSL certs.

but one thing to note is that the free tier has a 100MB file limit. I got around some of that by using the tail scale vpn with a custom domain entry to point to the local network.

I did these changes (wire guard to tail scale, dns to tunnels, etc) at different times, which is why things aren't very consistent.

If you want to self host, rent some cheap server somewhere (I use Hetzner) the will act as a proxy and then configure frp.

It's basically what Cloudflare tunnel does, except you need to provide the public server instead of Cloudflare giving you one for "free."

@WhosMansIsThis@lemmy.world You Could in theory just use wireguard with nginx.

DNS pointing to Public VPS -> Nginx running on public vps -> Nginx resolving to internal wg IPS -> Any of your other devices.

I only used their quick tunnels for some testing as it doesn't need a domain and natively runs under Termux. For that at least it worked fine.
But I probably wouldn't use them for anything serious. Typically you're doing everything to avoid MITM, and now this is just the opposite of that.