Yes, the cloudflare SSH tunneling works well -- though I think the fact that SSL is provisioned means it'll show up in the cert transparency log, possibly attracting unwanted attention to probe my home systems.

I ended up turning that off and switching to Tailscale. Tailscale is set to advertise my home IP range (I chose one that's not 192.168 based which avoids problems with range conflicts). So I can just connect to Tailscale and connect to 10.X.Y.Z as though I'm home. If I want memorable hostnames I can point DNS records to those private IPs.

You don't even need your own hardware. You can serve your site using the free CF Workers plan. Of course, that's a different goal than running bsd in an aggressively tiny cloud instance.

You still have to pay for electricity. If you consider that "completely free" then paying $4 per month should also be considered "completely free".