am I getting this right, that for 2 bucks a month I can publish (okay tun) my dockers and very-unsafe-postgres-with-ssl publicly to selected users?
Correct! The tunnels are protected using ssh auth as well, so you can ensure that only the users you want to access it can.
Cloudflare makes that free through their zero trust stuff and cloudflared daemon.
Correct! The tunnels are protected using ssh auth as well, so you can ensure that only the users you want to access it can.