Tailscale only requires one app install, on a device in your network.

That device can be configued as a subnet router (providing local network access to Tailscale connections).

Then using either the Funnel or Serve option, remote devices can access your Tailnet without a client installed.

Just an option, another way of achieving similar results (though with different capabilities) as Cloudflare.