It works with all NATs/CGNATs by connecting from the pi over a bidirectional WS connection. PI <-> WS <-> Cloudflare. SSL is done on the cloud, not on the pi.
Install any web server on the pi and "cloudflared" to proxy it.
https://developers.cloudflare.com/cloudflare-one/connections...
And then the third-party doctrine applies and they can tap you without a warrant and nail you for your private friend message board where you discussed smoking a joint or getting an abortion, if cloudflare complies. A main advantage of self-hosted in the home is supposed to be basic 4th amendment protections.
It's illegal for the federal or state gov to read US mail correspondence or tap phone lines without a warrant and should be for digital stuff too, but the third-party doctrine totally undercuts it.
I used to run an IRCd on 56k where it would disconnect you after three hours. With two modems timed just right you could dial-back in to the ISP on the second modem just as the other disconnected and have about a near second of downtime with no connection loss. Some of the best Quake 3 servers I played on were on 56K; truely a magical expirence now lost.