davidkelley/ssh-web-tunnel repository overview

⁠Expose your localhost

Deploy ☁️. Connect using SSH 🔒. Expose any local port to the web 🌎.

Once deployed, this project provides a HTTP and (emulated) SSH server configured to allow connected clients to expose a local port to the web, using SSH remote port forwarding.

No download is required for clients, they can connect using any SSH application, from Linux, Mac or Windows. Each connection is assigned a random, human-readable HTTPs subdomain, which can be connected to using any standard client, such as Firefox or cURL.

⁠⏱ Getting Started

Assuming you have AWS credentials configured locally⁠, in addition to a working Route 53 Hosted Zone (I'll use localhost.team as an example); after cloning the repository, you can deploy this solution with the following command:

aws cloudformation deploy --template-file cloudformation.yml --stack-name ssh-web-tunnel --capabilities CAPABILITY_IAM CAPABILITY_AUTO_EXPAND --parameter-overrides ZoneApex=<localhost.team>

Once successfully deployed, you can expose a web server running on localhost:3000 with the following command:

ssh -R 0:localhost:3000 ssh.localhost.team

Congratulations, your local web server is now exposed to the internet 🎉. The server should reply with a URL telling you the subdomain it chose for your connection, which should be something similar to "https://spotty-tiger-65.ssh.localhost.team⁠"

⁠📖 About this project

Written in Typescript, it uses the (fantastic) ssh2⁠ library to simulate an SSH server and Node's Net library⁠ to provide a server, for proxying HTTP connections to the connected client's tunnel.

Once deployed, it creates an isolated VPC and deploys an EC2 instance (Amazon Linux 2) running a privileged docker container⁠ in host networking mode. It uses a NLB⁠ for handling TCP connections and a separate ALB⁠ for terminating HTTPS connections and forwarding them to the EC2 server. The container itself has a restart policy configured, with health checks eventually terminating the server (and replacing it) if the container dies for some reason.

DNS configuration is via a delegated route 53 hosted zone, all ssh.<domain> connections are handled by the NLB, with all *.ssh.<domain> requests being forwarded to the ALB. An ACM⁠ certificate is also automagically created using a lambda-backed custom CloudFormation resource, providing https://<subdomain>.ssh.<domain> only access.