I had a need to expose a local HTTP server on the public internet without using one of my local static IPv4 addresses and without using IPv6 (don’t ask, it’s a long weird situation involving asymmetric routing and the fact that Claude Desktop is inside a captive NodeJS sandbox and does not trust RFC1918 or localhost addresses for MCP servers)… anyway, I didn’t want to subscribe to any proxy service or deploy a whole operating system inside an EC2 instance to host anything because that would require patching and all sorts of faff.
So I built a custom AWS EC2 AMI using https://gitlab.com/buildroot.org/buildroot, with only Dropbear https://matt.ucc.asn.au/dropbear/dropbear.html inside it and nothing else.
See https://gitlab.com/nicolaw/ssh-tunnel-ami.
I’m pondering incorporating some interesting stuff with https://github.com/yrutschle/sslh, https://github.com/proxytunnel/proxytunnel and an OAuth fronted webserver that will forward https://hostname/portnumber to http://localhost:portnumber so that any SSH reverse proxying will automatically have a nicely terminated trusted TLS connection with optional authentication.