I don't think it is explicitly against the ToS any longer, although it used to be from what I can gather. There is no longer a section 2.8 here but it does state in section 2.7:
You agree not to...(b) post, transmit, store or link to any files, materials, data, text, audio, video, images or other content that infringe on any person’s intellectual property rights or that are otherwise unlawful
So as long as you either only host original content or your media server requires login and is not open to the public then I don't think you'd have any issues.
I actually use a Cloudflare Tunnel in this way to serve a Jellyfin docker container and have not had any issues. I also disabled Cloudflare caching though for the subdomain that Jellyfin is served from, in order to be sure Cloudflare wasn't caching that media either.
I don't think it is explicitly against the ToS any longer, although it used to be from what I can gather. There is no longer a section 2.8 here but it does state in section 2.7:
So as long as you either only host original content or your media server requires login and is not open to the public then I don't think you'd have any issues.
I actually use a Cloudflare Tunnel in this way to serve a Jellyfin docker container and have not had any issues. I also disabled Cloudflare caching though for the subdomain that Jellyfin is served from, in order to be sure Cloudflare wasn't caching that media either.