I should point out that there are plenty of open source, self-hostable alternatives to Cloudflared, which you can run directly on your own VPS or any server you control, to enable the same architecture design.

Pangolin is a popular solution that combines a VPS-hosted dashboard and reverse proxy (Traefik) to securely expose local services behind NAT or CGNAT without opening inbound router ports. Headscale + Tailscale Funnel / Reverse Proxy, WireGuard + Standard Reverse Proxy (Nginx / Caddy), and FRP (Fast Reverse Proxy) are other options.

Using these alternative self-hosted solutions to Cloudflared is similar in concept to how I host a Rustdesk mirror on one of my VPSs, as a remote desktop solution for machines where Chrome Shared Desktop can't be installed. The open source community provides deeply capable solutions :)