sish is a production-grade, self-hosted SSH tunneling server written in Go — an ngrok/serveo alternative that requires no client-side software because it leverages the standard OpenSSH client. Users create reverse tunnels with ordinary commands like `ssh -R foo:80:localhost:8080`, and sish exposes the local service publicly over HTTP(S)/WS(S), raw TCP ports, or private TCP aliases. The code is a monolithic single binary split into three cooperating packages: sshmuxer (SSH server), httpmuxer (HTTP/HTTPS front end), and utils (shared state). The core architecture is elegant: each forwarded tunnel is materialized as a Unix socket listener; public-facing HTTP/TCP listeners proxy to those sockets through round-robin balancers, so the SSH transport layer and the network front end are cleanly decoupled. This is a pure application repo with no data/analytics components. Key control flows: the SSH server handles tcpip-forward global requests, creates a temp Unix socket per tunnel, and registers it in an in-memory state (syncmap-backed maps). The HTTP layer (gin + vulcand/oxy reverse proxy) matches incoming Host headers against registered HTTPHolders and dials the corresponding Unix socket via a base64-encoded address in the URL. The system supports load balancing (multiple clients binding the same subdomain/port/alias), SNI-based TLS routing without termination (achieved by peeking the ClientHello via a fake handshake), TCP aliases with optional per-alias SSH fingerprint allowlists, custom domain verification via DNS TXT records, on-demand Let's Encrypt certificates via certmagic, static certs with hot reload, PROXY protocol in both directions, IP/country filtering, and HTTP-based external auth for both keys and passwords. Admin and per-service web consoles stream request/response details over WebSockets. Engineering quality is notably high for the scope. Concurrency hygiene stands out: teardown handlers are wired only after forward setup completes (guarded by sync.Once) so connections dropped mid-forward do not leak routes, and the shared reverse proxy carries per-request response modifiers through request contexts rather than risking race conditions in a shared ModifyResponse. The test suite is unusually well-targeted — race-detector tests drop SSH connections mid-handshake to prove route cleanup, verify concurrent request/response pairing under a shared proxy, and cover gzip/304 edge cases in the response recorder. Weaknesses are minor: configuration is read from a global viper singleton throughout, which couples packages to globals, and the web console templates are dated (Bootstrap 4/Knockout with CDN deps).