For cloudflare tunnels no, it does a nat punch through I think it’s called, where it connects from inside your network out to 2 edge locations to cloudlfare, where it then can send traffic back and forwards.
If I wanted to expose by port forwarding, then yes you are correct, I could configure ddns.
Personally, I would configure my own version of DDNS where it’s just a cron job once every 5 minutes to run terraform and check if my public IP has changed, and if it has run an apply.
Does that answer the question?
Sounds very cool, and I’m going to be a huge ass and say that could have easily been done with k3s and either flux or argo image watcher.
+1 for terraform at home tho, I do the same and people look at me like I’ve curb stomped their child