Remember not to compromise security in favor of privacy. To me they’re both important, but security wins every time.

Remember that services directly accessible over tunnels, whether from cloudflare or frp or ngrok or whatever, are directly accessible over the internet. So if any of those various self-hosted services have a remote vulnerability, and EVERYTHING does sooner or later, you will be exposed. This is why I personally WG VPN to my home LAN rather than exposing most of my stuff via any sort of tunnel. Tailscale is another option I often recommend.

I do use CF tunnels for specific purposes; Home Assistant Google Home integration for example, but I secure that via their “zero trust” authentication by validating incoming IP ranges, so only Google can reach the tunnel in the first place, everybody else is stopped by Cloudflare. For other services with human users, I have them authenticate via github or google oauth first. I also run all services accessible by the internet by any means on a restricted VLAN firewalled off from the rest of my LAN.