spike VS ssh-punchhole

slince / spike

At home, just a bunch of AlmaLinux VMs with K3s, using MetalLB for LoadBalancerIPs in my LAN and ssh-punchhole to forward ports from an externally hosted VPS to my local ingress-nginx and other things, so my stuff is externally available.

Get yourself a cheap VPS and then try something like https://github.com/TamCore/ssh-punchhole (which i hacked together, because everything else just looked too bloated for my taste). That way you can host everything at home and don't have to forward any ports, as the tunnel is established from within your network :)

I've published my setup for that case as a container image: https://github.com/TamCore/ssh-punchhole.

I've published my setup on Github: https://github.com/TamCore/ssh-punchhole Even if you don't use Docker, you could still basically use the script as standalone. I just wanted to have everything neatly packaged :)

I use a VPS as my public endpoint, but the tunnel is established from my network, as it's based on reverse SSH port forwarding. So no port forwarding in my router required and would even work with CGNAT and whatsoever. Sample configs I've published under https://github.com/TamCore/ssh-punchhole

If you don't want to mess around with port forwarding, I'd recommend just getting a cheap VPS somewhere close to you, and hosting Traefik and something like my ssh-punchhole (see https://github.com/TamCore/ssh-punchhole) for tunneling inbound traffic to your service.

Using haproxy (lightweight and quickly configured) was an easy fix for that issue. I've included the relevant parts from my configs in https://github.com/TamCore/ssh-punchhole/blob/main/README.md :)