[ Removed by moderator ]

(This is directed to self-hosters who use Cloudflare Tunnels (cloudflared) and the Cloudflare ecosystem. And I'm not going to debate the pros or cons of using a Cloudflare Tunnel, as they have been brought up in countless other posts. I use CF services, and I'm happy with them. YMMV, of course.)

Cloudflare Tunnels are an excellent, free, and reliable way to connect a subdomain to a local service without exposing ports. It's tried and tested, and the learning curve is not that steep.

But, your nicely connected service is now public, as in available to anyone. Is that what you really intend?

"Oh, but I use 2FA or strong passwords on my internal service." No. That is not the solution.

Research Cloudflare Applications. These sit between the visitor and the Cloudflare Tunnel, prompting for the user authentication. And the nice thing about Cloudflare Applications is that all authentication happens on CF's servers, so your servers are never touched until the user successfully authenticates.

Cloudflare provides several authentication methods, from simple OTCs to OAUTH or GitHub authentication. And you can apply many Rules to narrow down who can connect (IP ranges, countries, etc.).

So, unless your exposed service is intended to be publicly accessible, like a public-facing website, look into Cloudflare Applications.

(Yes, there are many alternative solutions. But again, countless other posts provide excellent details.)