A developer has created a method to expose locally running web services through SSH tunneling and nginx, eliminating reliance on third-party tunneling platforms.

The approach uses only OpenSSH and nginx, both commonly available on Linux servers. By configuring an SSH remote forward with port 0, the server automatically assigns an unused port for redirection. Nginx then proxies incoming HTTPS requests to this dynamically assigned port.

DNS records for *.ssh.luffy.cx point to the server, and wildcard TLS certificates are obtained via Let’s Encrypt through Route 53. Access to the tunnel endpoint requires a cryptographically signed URL component that includes an expiration timestamp, port number, and shared secret. This token is embedded in the URL path and validated by nginx using the secure_link module.

When a request arrives, nginx checks the token's integrity and validity. If the hash does not match or the link has expired, access is denied with appropriate HTTP status codes. Valid requests are forwarded to the local service, with authentication headers stripped to prevent upstream leakage.

A helper script automates the process by detecting allocated ports from active SSH sessions, generating time-limited tokens, and outputting shareable URLs. The script maintains the tunnel session indefinitely until manually terminated.

This implementation offers a lightweight, self-contained alternative for developers seeking to share localhost services publicly without depending on external tunnel providers.