cloudflared makes the tunnel the identity of the box, not its ip. This means you can spin up a new machine, if the old one dies, and put the same tunnel on it and it looks like nothing ever happened to the external world.