@timbray @evan sure thing! I'll draft something shortly. In the meantime, the high-level explanation is you install the Cloudflare daemon to tunnel traffic from the DO instance to a CF endpoint, without exposing any ports, or the instance IP address. CF docs here -> https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/remote/#set-up-a-tunnel-remotely-dashboard-setup