When setup with tunnels, cloudflare doesn’t see any media traffic. Cloudflare only needs to serve the auth and handshakes. The actual traffic is IP to IP, TLS encrypted if you setup a domain correctly. Or just use something like tailscale that sets up the certificates and domains for you.

You have a VPS that relays the pangolin tunnel and a reverse proxy serving the tunnel through a cloudfare + fail2ban protected domain. It should be really cheap since the vps only really runs for the initial auth and connection, and once in a while to update the tunnel IPs. You just give people a domain and a credential for the client.

It sounds complicated but isn’t really. I did it once but then returned to plain tailscale since I don’t really share my server with many people.

That’s a per client behavior. Wholphin for Android, for example, does it the Plex way.

My chances of sharing a Plex library with grandma are also zero. I would still have to set it up for her. That’s a non argument.