Cloudflare Tunnel with Raspberry Pi: Debugging

I am attempting to connect to my Raspberry Pi using SSH, VNC or RDP. The last two preferred.
I have set up all three, and on my list of tunnels they show up as being “healthy”
I have also attempted to set up applications. SSH show up as being self-hosted.
I get a response when I ping the subdomain such as rdp.my-doman .com, ssh.my-domain .com, vnc.my-doman .com
Furthermore, I can access ssh, VNC and RDP locally without a problem through their local IP address.
This suggests that I have not set up access policies or other arcane settings in Cloudflare.
How do I debug this? Does anyone have a checklist of setting? …Or a minimum happy path of settings?
I’m new to using Cloudflare, and I think I’m really close to getting this working, I cannot figure out how to get any error messages to tell me what I might be doing wrong. The combinatorial explosion of possible incorrect setting quickly approaches the complexity of the universe :slight_smile: I’ve read a number of articles, blog posts and watch videos. Please, somebody, enlighten me.