I used v2ray+nginx on a linode instance to expose NAT-ed port. I have tried cloudflared before but it seems to not able to proxy the cockpit GUI well. And the credentials (for the whole domain) will have to stay with the device, that make me a little nervous.