SSH into private machines from anywhere using Cloudflare Tunnel

Why not just run Wireguard on a raspberry pi, set up DDNS to send your home IP to a Dynamic DNS provider (if you're on a dynamic IP), and then SSH to your machines at home using keys (instead of passwords)?

Setting up a Pi and running the Wireguard install script is about half an hour of work.

If you're using ddns why do you need WireGuard at all?

I use a similar setup. The VPN is needed because it is the only port accessible outside my network. Wireguard is easy to setup right, and I already need it for accessing other stuff on my home network.

Wireguard needs an endpoint

If I understand GP correctly, the goal is to SSH into an RPi on a home network. Since they mention DDNS, it's implied that they're connecting directly to their home router. What I'm saying is why not port forward directly to the RPi?

Yes you are right. If just connecting to the Pi, port forwarding is fine (and I use this).

When adding more devices at home (IP cameras etc.) and not connecting just to the Pi then the Wireguard VPN comes in.