TL;DR
Get monitors, keyboards and dev gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
Vincent Bernat describes a self-hosted way to share a local web service over HTTPS using OpenSSH remote forwarding and Nginx. A helper script finds the port allocated by SSH and creates a signed link that expires after a set lifetime; the report does not provide independent security testing or operational adoption data.
Vincent Bernat has published a technical report describing how to expose a web service running on a local computer through a self-hosted HTTPS address, using OpenSSH remote forwarding and Nginx. The approach gives people a way to share a work-in-progress preview without relying on a commercial tunnel service, and adds links that expire after a configured period.
The setup starts with an SSH remote forward from a server to a service on the user’s machine. In the example, the user runs ssh -R 0:localhost:8080; setting the remote port to zero lets the SSH server allocate an available port. Nginx then accepts HTTPS requests for a hostname containing that port and proxies them to the corresponding local port on the server. The sample configuration also supports WebSocket connections and disables proxy buffering.
To make the service reachable, the operator needs a wildcard DNS record and a wildcard TLS certificate. Bernat’s example uses Let’s Encrypt, with DNS records and an ACME DNS-01 challenge arrangement. The tunnel therefore depends on control of a domain and server as well as a working OpenSSH and Nginx configuration.
The port alone would be discoverable and would provide weak access control. Bernat’s design adds a URL username containing a signed hash and an expiration timestamp. Nginx’s secure-link module checks the hash against a secret, the port and the expiry time. The configuration returns 401 for a missing or invalid signature and 410 for an expired link, then removes the Authorization header before proxying the request. A helper script identifies the port allocated to the SSH session, generates the signed URL and keeps the session open.
The design offers a practical option for developers who need to let someone else view a local site, such as a draft blog post, while keeping the tunnel infrastructure under their own control. It uses a standard SSH client and a web server that many operators already run, and can serve the preview over HTTPS on a custom domain.
Self-hosting also moves responsibility to the operator. They must maintain the server, DNS and certificate setup, protect the signing secret, and decide who receives a link. The source describes an expiring signature as an added access check; it does not establish that this configuration has been independently audited or that it is suitable for sensitive services. The article’s value is a reproducible implementation path, rather than evidence of broader uptake or a measured security comparison.
As an affiliate, we earn on qualifying purchases.
From SSH Forwarding to Signed Links
HTTP tunnels make a service on a private or local network accessible through a public endpoint. Bernat contrasts commercial options such as ngrok and Cloudflare Quick Tunnels with self-hosted tools that require a dedicated client, and with SSH-based services that depend on a particular SSH server. His proposal combines OpenSSH for the forward and Nginx for HTTPS proxying.
The main operational wrinkle is that OpenSSH can choose a free remote port when asked to bind port zero, but the assigned value is not exposed through an environment variable in the described setup. The helper script works around this by examining ancestor SSH session processes and the server’s listening TCP sockets. It then uses the discovered port to produce a link signed with OpenSSL. The supplied report does not state an adoption timeline or compare performance with hosted services.
As an affiliate, we earn on qualifying purchases.
Security and Deployment Limits
The supplied report does not include an independent security review, tests under load, or evidence about how widely the setup has been deployed. It also does not establish that a signed link protects the service against every threat; security depends on the server configuration and handling of the secret. The example includes a secret directly in the Nginx configuration, but the material does not discuss secret rotation or how operators should distribute links. The reported setup is a technical example, not a guarantee of security for sensitive data.
wildcard TLS certificates for Nginx
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Operator Setup and Maintenance
Anyone following the example would need to configure SSH remote forwarding, Nginx, wildcard DNS and TLS issuance, then install and adapt the helper script for their server. The script in the report uses a one-day link lifetime. Operators would need to set their own lifetime and secret and keep the SSH session running for the tunnel to remain available. The source gives no announced follow-up release or deployment milestone, so further development and adoption remain unknown.
signed URL generator for web links
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does the proposed tunnel do?
It lets a user share an HTTPS address that proxies requests to a web service running locally, such as a development preview on port 8080.
Does it require a dedicated tunnel client?
The report’s approach uses an SSH client for remote forwarding, alongside a server running OpenSSH and Nginx. The helper script automates link generation on the server.
How does the link expire?
The URL includes an expiry timestamp and a signature. Nginx’s secure-link module checks the signature and timestamp; the example returns HTTP 410 when the link has expired.
What infrastructure does an operator need?
The example requires a server with OpenSSH and Nginx, a domain with wildcard DNS, and a wildcard TLS certificate. The operator also needs to configure the signing secret and run the SSH forward.
Has the configuration been independently audited?
The supplied report does not describe an independent security audit, so it does not establish that the example is suitable for sensitive services.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
