Using a tunnel for SSH?

I have a Cloudflare tunnel for a Raspberry Pi http service, and it works great. I would really like to avoid opening up a port on my router to externally access it, but I don't know the best way to do that with a channel.

I'm ok enough with having to use cloudflared to run ssh but I'm not 100% sure what I'm doing.