$ show antoniomika/sish
sish is a production-grade, self-hosted SSH reverse tunneling server written in Go. It acts as a multiplexer that accepts SSH connections and forwards HTTP(S), WebSocket, TCP, and TLS (SNI) traffic to local services. Unlike ngrok or serveo, sish requires no custom client—users connect with standard SSH remote port forwarding. The server listens on SSH (default 2222), HTTP (80), and HTTPS (443) ports, and uses unix sockets for internal routing. It supports load balancing, TCP aliases, custom domains via DNS verification, on-demand Let's Encrypt certificates, and a real-time web console for inspecting forwarded requests. The architecture is monolithic but highly concurrent, leveraging goroutines and syncmap for state management. The codebase is well-structured with clear separation of concerns: SSH multiplexing (sshmuxer), HTTP handling (httpmuxer), and shared utilities (utils). It includes integration tests for authentication key requests and connection cleanup. The project is actively maintained with regular releases, CI/CD pipelines, and comprehensive documentation.
The LLM identified 4 files worth highlighting for reuse:
Defines the SSHConnection struct and associated methods for managing SSH sessions, including listener tracking, cleanup, message passing, and deadline support. Also implements utility types like TeeConn for TLS SNI peeking, IdleTimeoutConn for idle connection timeout, and the CopyBoth function for bidirectional data transfer. These components are well-isolated and could be extracted for any SSH or TCP connection management use case.
Implements the handleSession function that parses SSH session command flags (e.g., proxy-protocol, host-header, strip-path, deadline) and applies them to the connection. The flag parsing logic is cleanly separated and extensible, allowing users to configure per-connection behavior without modifying core forwarding logic. This pattern is reusable for any SSH-based application that needs dynamic configuration.
Provides a custom RoundTripper that dials unix sockets (base64-encoded in the host field) and a ResponseModifier function that captures request/response data for the web console. The round tripper pattern is a clean abstraction for routing HTTP traffic through unix sockets, which could be reused in other projects requiring socket-based proxying without modification.
Contains core utility functions for port range checking, random port generation (GetRandomPortInRange), subdomain/alias allocation with conflict resolution and load balancing support (GetOpenHost, GetOpenAlias, GetOpenPort), DNS verification, SSH key loading, and configuration setup. These functions are self-contained and demonstrate non-trivial logic for managing shared resources in a multi-tenant tunnel server.