TL;DR
Get monitors, keyboards and dev gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
A report published by Vincent Bernat describes a self-hosted HTTP tunnel built from OpenSSH remote port forwarding and Nginx, with HTTPS links routed to services running on a user’s computer. The design adds expiring, signed links, but it is a technical implementation rather than a reported product launch; its security depends on configuration and secret management.
Vincent Bernat’s 2026 report describes a way to share a locally running web service through a public HTTPS address using OpenSSH and Nginx, without a dedicated tunnel client or a commercial relay service. The setup assigns an ephemeral port on a remote server, routes a matching subdomain to it, and can issue a time-limited signed link for access.
The connection begins with SSH remote forwarding: a user connects to a server and asks OpenSSH to bind remote port 0, allowing the server to select an available port, then forward traffic to a service such as a development preview on localhost:8080. Nginx accepts HTTPS requests for a subdomain containing that port and proxies them to the corresponding local port on the server, where the SSH forward carries traffic back to the user’s machine.
Bernat’s example uses a wildcard DNS record and a Let’s Encrypt wildcard certificate to serve the generated subdomains over HTTPS. To limit access, the report uses Nginx’s secure_link module to check a URL credential derived from an expiration time, the allocated port, and a shared secret. The configuration rejects missing or invalid credentials with an HTTP 401 response and expired links with HTTP 410.
The report also describes a helper script that finds the port allocated to the SSH session by inspecting server-side processes and listening sockets, then prints a signed URL and keeps the SSH session open. That method relies on server access to process and socket information, including non-interactive sudo access in the example. The published account presents this as an implementation approach, not as a managed service or a measured comparison with existing tunnel products.
The approach offers developers and teams a way to let someone outside their network review a local web preview while keeping the forwarding infrastructure under their own control. It may suit environments where installing a separate client or depending on an external tunnel provider is undesirable, since the design uses familiar OpenSSH and Nginx components.
That control comes with operational work. The operator must maintain the remote server, DNS, TLS certificates, Nginx configuration, SSH access, and the signing secret. The design also does not make a local service private by itself: once a URL is shared, anyone with a valid link may be able to access it until it expires, depending on the application and configuration. The report’s expiring token reduces reliance on an unpredictable port alone, but should not be treated as a substitute for application-level authentication or a security review.
As an affiliate, we earn on qualifying purchases.
How SSH Forwarding Meets HTTPS
HTTP tunnel services commonly expose a local web server through a publicly reachable endpoint. Bernat’s report contrasts hosted options such as ngrok and Cloudflare Quick Tunnels with self-hosted tools that may require a purpose-built client or a particular SSH server. The proposed arrangement instead uses a standard SSH client and OpenSSH on the remote host, with Nginx handling public web traffic.
In the basic configuration, SSH creates the route from the remote server’s selected port back to the local service. Nginx maps a request such as p41535.ssh.luffy.cx to that port. A wildcard DNS entry directs the relevant subdomains to the server, while certificate automation supports HTTPS. Bernat’s example uses NixOS for certificate management and Route 53-hosted DNS for ACME DNS-01 challenges; those are details of his environment, not requirements established for every deployment.
As an affiliate, we earn on qualifying purchases.
Deployment and Security Limits
The report does not provide independent security testing, performance measurements, or a comparison of reliability and maintenance costs against hosted tunnels. It also does not establish that the setup is suitable for every server environment: the helper script’s process inspection and sudo assumptions may need adaptation, and Nginx, DNS, certificate renewal, and SSH behavior can vary by system.
The shared secret in the example configuration is an illustrative value and must not be reused as a real credential. The report’s URL token has an expiration time, but the source does not describe revocation, rate limiting, or protection against every form of link leakage. Readers should treat the configuration as a technical example and verify access controls, secret handling, and exposure of the underlying application before using it with sensitive content.
wildcard SSL certificate for Nginx
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Operators Must Configure
Anyone adapting the design would need to configure an SSH-accessible host, remote forwarding, a wildcard DNS route, HTTPS certificates, and Nginx proxy rules. They would also need to set a private signing secret and decide how long links remain valid. Bernat’s report describes a helper script for generating URLs, but it does not announce a broader release schedule or a maintained hosted offering.
The practical next step is testing the setup in the operator’s own environment, including how the SSH session is kept alive, how forwarded ports are identified, and how expired or invalid links are handled. Until such testing or independent evaluation is available, the report establishes a workable design example, not a general guarantee of security or operational suitability.
self-hosted tunneling server setup
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does the reported setup do?
It exposes a web service running on a user’s computer through a public HTTPS URL. OpenSSH remote forwarding carries requests from a remote server to the local service, while Nginx proxies incoming web requests to the forwarded port.
Does it require a dedicated tunnel client?
The report’s design uses a standard SSH client rather than a purpose-built tunnel client. It does, however, require the operator to configure and maintain the remote server, Nginx, DNS, and certificates.
How are the links restricted?
Bernat’s configuration uses Nginx’s secure-link check to validate a token based on the port, expiration time, and a shared secret. Invalid credentials receive a 401 response, while expired links receive a 410 response. The report does not claim this replaces authentication in the application itself.
Is the implementation independently security-tested?
The source material describes the configuration but does not report an independent security audit or testing results. Operators should review the setup, use a unique secret, and assess whether exposing the specific application is appropriate.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
