If it helps, you can think of the cloudflare tunnel as analogous to a VPN. You don’t need separate tunnels unless the services involved can’t communicate with each other; if they can route to each other already, they should all be discoverable from the tunnel.

It sounds like 1016 and 1033 are both DNS errors, or other connectivity. Your tunnel was up before; it sounds like restricting to just email night have blocked something it shouldn’t. How did you block it? Cloudflared needs specific ports open, so if you blocked ports, that might be the issue

With keycloak you can have a single local password to all your selfhosted apps: you sign in to keycloak, then you sso into everything else from there. I’m building that out on my homelab right now, and it’s working fine.