Use cloudflared for SSH and close port 20

Cloudflare tunnels can be used for SSH, meaning you don't need any open incoming ports on your VPS.