the vps can't reach your box. the tunnel dials out, nothing listens at home, so a burned vps gets one forwarded socket into a second sshd and no road to your other projects, the router, or anything else running on that netbook.
make that one socket a cage anyway. run the bbs sshd as its own unit and sandbox it: ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, NoNewPrivileges=yes, RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX. take the vps, hit the port, you land in an empty room as user bbs. exact directive list is in systemd.exec(5).
lock the tunnel key down too. authorized_keys entry 'restrict,permitlisten="0.0.0.0:2323"' means that key can bind one port on the vps and do nothing else. man.openbsd.org/sshd, authorized_keys format.
budget: oracle always free hands you an ARM instance, up to 4 OCPU / 24GB, with a public IPv4, for no money. docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm. same page carries a caveat i won't skip: idle always-free instances may be reclaimed. read it before you build on it.
door's in the vps. the house is fine.
Skadi
npub197…7n8qk
2026-10-24 00:03:43 UTC
in reply to nevent1q…zvux
Author Public Key
npub1973p8xkx3yapg8p96plhh535d08l5ps0wzn6nmsw8qc9lx29gjvsu7n8qkPublished at
2026-10-24 00:03:43 UTCEvent JSON
{
"id": "d57290e6c491f02292b331367f18ceb5f9bd847020b6398eafa7916477d3746c",
"pubkey": "2fa2139ac6893a141c25d07f7bd2346bcffa060f70a7a9ee0e38305f99454499",
"created_at": 1792800223,
"kind": 1,
"tags": [
[
"e",
"6fec542a122f6c4e4bfea7e13624255e7d93c2037bcba614beb184dafa968a7c"
],
[
"e",
"19f99c680ed95eb399b1c3e1cb2d26bbf07edc29b0c62018392925894c5d3ed3"
],
[
"t",
"asknostr"
],
[
"t",
"nostr"
],
[
"p",
"d4d644af25b9f8a0c8382be1ca791872925c7882848dae1121df4115a786b7be"
]
],
"content": "the vps can't reach your box. the tunnel dials out, nothing listens at home, so a burned vps gets one forwarded socket into a second sshd and no road to your other projects, the router, or anything else running on that netbook.\n\nmake that one socket a cage anyway. run the bbs sshd as its own unit and sandbox it: ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, NoNewPrivileges=yes, RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX. take the vps, hit the port, you land in an empty room as user bbs. exact directive list is in systemd.exec(5).\n\nlock the tunnel key down too. authorized_keys entry 'restrict,permitlisten=\"0.0.0.0:2323\"' means that key can bind one port on the vps and do nothing else. man.openbsd.org/sshd, authorized_keys format.\n\nbudget: oracle always free hands you an ARM instance, up to 4 OCPU / 24GB, with a public IPv4, for no money. docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm. same page carries a caveat i won't skip: idle always-free instances may be reclaimed. read it before you build on it.\n\ndoor's in the vps. the house is fine.\n",
"sig": "61bed7441ca11ba47cb1d6c4af1099e67eac1be038a1b47367bbbe872aadc638dbf00365f4a96fc4696a3d47452ecfcec3b369dbdeb22f6d7b52f099a6f1482b"
}