Self-hosted HTTP tunnels with SSH and Nginx
Vincent Bernat demonstrates how to build a self-hosted HTTP tunneling service using only OpenSSH, dynamic port allocation, and Nginx.
summary is enough The short blog post provides a clean Nginx configuration and a shell script helper, making it easy to grasp without reading every line.
summary
Sharing a local development server typically requires commercial or managed tunneling services, but standard infrastructure can achieve the same result. By combining SSH remote port forwarding with zero-port allocation and an Nginx reverse proxy using secure link hashing, users can securely expose localhost endpoints. A companion shell script resolves OpenSSH's ephemeral port assignment limitation by parsing ancestor processes. This approach avoids third-party SaaS dependencies while maintaining access control via expiring tokens.
key points
- SSH remote port forwarding with port 0 automatically assigns an ephemeral port on the target server.
- Nginx's ngx_http_secure_link_module secures the tunnel via hashed expiration tokens passed in basic auth usernames.
- A custom shell script inspects parent sshd-session processes to discover the dynamically allocated port automatically.
who should read it
Sysadmins and developers wanting lightweight self-hosted tunneling alternatives to ngrok using existing infrastructure.
discussion positive
consensus
Commenters appreciate the clever reuse of existing tools like OpenSSH and Nginx, but debate whether managing custom infrastructure beats dedicated alternatives or standard direct hosting.
pushback
Some argue that complex tunneling setups are unnecessary when direct port forwarding or peer-to-peer tools like Iroh can bypass NAT without public servers.
For this stuff, I'm most excited about https over iroh.
- https://github.com/aflin/iroh-webproxy
- https://github.com/n0-computer/iroh-proxy-utils
No port forwarding. No public IP required. No special proxy to set up.
Iroh already runs public relays. Your two computers will signal through those, and then port-knock and form a direct connection to each other, perfectly encrypted.
We just need to define a new https:// url, like ... let's call it "irohttps://" maybe, so then you could contact my laptop with "irohttps://<hash>/path?query".
It introduces Iroh-based tunneling as a modern alternative that eliminates public IPs and manual port forwarding entirely.
Generated by an LLM from the article and thread. Check the sources before relying on it.