You might want to be more specific, cloud flare has a lot of different products, and you’re getting answers with differing assumptions.

For the self hosted focus, I use tail scale already, and when (not if) that company gets shitty, I will switch to head scale, or a competitor, or straight wire guard (plus firewall etc).

But I also run web sites on cf, and there’s no real alternative, definitely not for free. I don’t have hundreds of millions to spend on the CDN part, for starters.

I looked in to this a while back and didn’t find anything complete. I ended up using a collector and feeding the reports in to my existing Loki and making my own Grafana dashboard.

I used to. It’s really complicated and not big in the self hosted space.

I’d recommend the standard Prometheus, alert manager, and grafana stack instead. That’s what I use now, and although yaml sure is something, at least there’s tons of people to copy.

Use the DNS challenge instead? You’ll need a DNS provider with an API though

I use this, it’s fine, but development on the open version is very very slow.

And they still haven’t fixed my pet bug: they introduced Unix socket listening, I found that enabling it prevented upgrades, reported the bug with details and repro, and nobody cares. The workaround is simple, delete the socket file before every start. But I remain confused why a bug that prevents upgrades remains.

By default, unencrypted, and unauthenticated, and permissions rely on IDs the client can fake.

May or may not be a problem in practice, one should think about their personal threat model.

Mine are read only and unauthenticated because they’re just media files, but I did add unneeded encryption via ktls because it wasn’t too hard to add (I already had a valid certificate to reuse)

You could use a reverse proxy to terminate tls, and take the tls off of ad guard itself.

Reminds me of years ago I wanted to play Lush, the radio station from SomaFM.

Literally could not get anything but Rush. And I have zero Rush in my library.