TL;DR
Get monitors, keyboards and dev gear delivered free — and shop member deals
- Fast, free delivery on millions of items
- Access to Prime Big Deal Days deals on October 6–7
- Prime Video, Amazon Music and more included
Vincent Bernat has published a technical report describing how to share a locally running web service through a self-hosted HTTP tunnel built with OpenSSH and Nginx. The setup assigns a remote port, routes HTTPS requests to it and can require a signed, expiring link; it is a configuration guide, not an announcement of a new service or independent security review.
Vincent Bernat has published a 2026 technical report showing how to expose a locally running web service through a self-hosted HTTP tunnel using OpenSSH and Nginx. The approach can let someone view a private preview over HTTPS without relying on a commercial tunnel provider, while signed links with an expiration time add a layer of access control.
The setup uses an SSH reverse forward to carry requests from a port on a remote server back to a local service. With port 0 specified in the remote-forward request, OpenSSH selects an available port and reports its number. In Bernat’s example, a service running at localhost:8080 is forwarded to a dynamically allocated port on the server.
Nginx then accepts HTTPS requests for hostnames that encode that port and proxies the traffic to the matching local port on the remote server. The report’s configuration uses a wildcard DNS record and a Let’s Encrypt wildcard certificate so those port-specific hostnames can use HTTPS. It also includes proxy settings for WebSocket connections and passes the requested host and forwarding information upstream.
Bernat says the port alone would otherwise be the main barrier to guessing an active tunnel. His configuration uses Nginx’s secure link module to check a URL credential derived from the expiration time, port and a shared secret. Invalid or missing credentials receive a 401 response, while a valid but expired link receives a 410 response. A helper script finds the forwarded port associated with the SSH session, prints a signed URL and keeps the session open.
The report offers an option for developers who want to share a temporary local preview while keeping the tunnel infrastructure on a server they administer. That can reduce reliance on a third-party tunnel service and avoid requiring collaborators to install a dedicated client: recipients can open an HTTPS link in a standard browser.
The trade-off is operational responsibility. The operator must configure and maintain SSH access, Nginx, DNS and TLS certificates, and the helper script depends on details of the server’s process and socket listings. The signed link also functions as a bearer credential: anyone who obtains it may be able to access the preview until it expires. Bernat’s write-up describes a practical access check, not a full security assessment or a guarantee that the setup is suitable for every sensitive service.
As an affiliate, we earn on qualifying purchases.
How the SSH Forward Becomes a URL
HTTP tunnel services typically make a local web application reachable from outside a developer’s machine. Bernat frames his example around a work-in-progress blog post available only on localhost:8080, which a friend needs to proofread. His report contrasts hosted services with self-hosted options and focuses on using ordinary OpenSSH and Nginx rather than a specialized tunnel server or client.
The flow has three parts: SSH carries traffic from the remote server to the local application, Nginx maps an HTTPS hostname to the allocated port, and a signed URL restricts access for a limited period. The report’s shell helper addresses a practical gap: OpenSSH does not expose the dynamically allocated remote port through an environment variable, so the script inspects the SSH server session and listening sockets to identify it.
As an affiliate, we earn on qualifying purchases.
Security and Deployment Limits
The report provides an implementation example, but does not establish that the configuration has undergone an independent security audit or formal testing across different server environments. It also does not quantify performance, reliability or operating costs against hosted alternatives.
The link protection relies on a shared secret and an expiring URL, so safe use depends on how that secret is stored, how links are distributed and how long they remain valid. The source does not provide a broader threat model or specify how the design handles every possible proxy, application or deployment configuration. Readers should treat the example as a technical recipe to review and adapt, not as evidence that sensitive services are protected by default.
Let’s Encrypt wildcard SSL certificate
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Testing the Configuration in Practice
Bernat’s report ends with a helper script that prints access URLs and keeps the SSH session alive; it does not announce a product launch or a scheduled follow-up. Anyone adopting the approach would need to adapt the example’s domain, server, certificate process and secret, then test the forwarding and access checks in their own environment.
Practical evaluation should confirm that unauthorized requests are rejected, expired links stop working, and the tunnel closes when the SSH session ends. Operators would also need to review how they distribute links and manage the server-side secret. The source does not say whether Bernat plans further updates or publish broader deployment guidance.
self-hosted web server security tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does the setup do?
It forwards traffic from an HTTPS address on a server through OpenSSH to a web service running on a user’s local machine.
Does the person opening the link need special software?
The recipient can use a standard web browser. The tunnel operator needs an SSH client and must configure the remote server with Nginx, DNS and TLS.
How does the link restrict access?
Nginx checks a signed URL credential based on the port, expiration time and a shared secret. The example returns an error for a missing or invalid credential and rejects a link after it expires.
Is this a new hosted tunnel service?
No. It is a technical report and configuration example for running the tunnel on infrastructure controlled by the operator, rather than an announcement of a hosted service.
Has the configuration been independently audited?
The source describes how the configuration works but does not report an independent security audit or formal evaluation. Its security should not be treated as independently verified based on the report alone.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
