Share a local preview through an SSH tunnel and nginx

Vincent Bernat builds a self-hosted way to share a local HTTP service using OpenSSH and nginx. SSH allocates a remote port and forwards it to the local application; nginx maps a hostname to that port. An expiring token adds access control, and a helper discovers the assigned port to print a usable sharing link.

Vincent Bernat · Oct 3, 2026

Why it matters

The walkthrough makes the components behind a preview-tunnel service understandable and reusable.

More context

Try it in a controlled environment if you already operate a server with OpenSSH, nginx, wildcard DNS and TLS certificates. The helper needs privileged socket inspection. Read the access-control section before adopting the configuration; a port number alone is a weak secret.

Keep in mind

This is a practitioner setup, not a hosted product or an audited security boundary. The author warns that a holder of the shared secret can reach other local TCP listeners through the proxy. Restrict exposure before using it with sensitive services.

Original read