Christian brings up some great points worthy of consideration; however, if your going to use traditional routing through their network (A/cname) your still doing the same thing. CF will still see your traffic.

The second thing I should say is, I only use zero trust for websites I share with family. So, I have a Searxng and wef/voyager dockers running through zero trust.

For admin, homeassistant/iot/ip cams, I use an always on IPSec vpn on my iPhone, iPad, and steam deck (take it to work and plug into 3rd monitor) … this is cool because I get 24/7 ad blocking no matter where I am because it routes all my traffic through my pihole at home. This is a great solution for a single person, but I do not want to manage vpn access for multiple ppl. So, I agree with christian in NOT putting admin stuff/sensitive info behind CF at all (zero trust OR tradition web routing) unless you fully trust them. Otherwise do a 24/7 vpn like I do.

I do this for some dockers in my unraid, except I use the zero trust tunnels. MUCH easier, can use SSL, and can set up a login page for users. Also, you don’t have to open any ports on your router!

Im not sure about synology, but I would assume you can find a “cloudflared” docker in the app store.

check out this youtube video for a good explanation: https://www.youtube.com/watch?v=ZvIdFs3M5ic

Currently my UPS is reporting 207 watts, that’s with a unraid server (3600 + 32GB ram + 2060 super for plex, and 6 drives), a mini pc for pf sense, a rpi 4 running pihole and vpn server, a single poe ap, a modem, and security cameras… it can spike to 250w with multiple encodes going on from family … but overall not bad… I did have a dedicated 20A switch installed for just my network closet as well