[threecheese]

My understanding is that only Tailscale is end-to-end-encrypted, though both ensure that all traffic is encrypted on the wire. I don’t claim this as fact because, unlike the Cloudflare docs, Tailscale’s claim (yell) that there is no way for them to decrypt.

I’d be pleased to be proven wrong (and jgrahamc is def ITT) as I use a bunch of CF services already and it would be great to have one less PaaS in my life.

[aborsy]

You are right. Tunnel and TLS both end on Cloudflare. It’s not end to end. In fact CF scans the traffic supposedly for malware.