test, add tunnel to the list.

tasks/general/acct_mgmt/provision_config.yml

@@ -164,7 +164,18 @@
       ;               Example: jim, bob, jeff, anne
       ;               Default: user
       ;
-      ; For pushing MASTER directories to an SFTP server with `send-master`.
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
+- name: General | Account Management | Provisioning Configuration | General | Create | Sync Shortcuts
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Sync Shortcuts'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;         Sync Shortcuts         ;;;;;;;;;;;;;;;;;;;;;
       ;
       ; Imagine the command:
       ;   `rsync -auPhz --delete -e 'ssh -p prod_data_port' ./mydata-MASTER/ \
@@ -193,6 +204,44 @@
     backup: true
     mode: "0644"
 
+- name: General | Account Management | Provisioning Configuration | General | Create | Tunnel
+  ansible.builtin.blockinfile:
+    path: "{{ gen_file }}"
+    marker: '; {mark} MANAGED BY ANSIBLE | Generic Config | Tunnel'
+    block: |
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; Tunnel ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+      ;
+      ; Create a runit script which maintains an SSH tunnel to a remote server.
+      ;
+      ;        ssh -v -H -R tunnel_remote_port:localhost:tunnel_local_port \
+      ;             [-p tunnel_ssh_port] tunnel_remote_host
+      ;
+      ; tunnel_local_port (default=8080)
+      ;   Local HTTP port which need forwarded to a remote server.
+      ;     Example: http://localhost:8080
+      ;
+      ; tunnel_remote_host (default=false)
+      ;   Remote server including username (such as user@example.com) which will
+      ;   serve the port. Server should preferably have a reverse proxy in order
+      ;   to encrypt the traffic, otherwise the local server should use HTTPS.
+      ;
+      ; tunnel_remote_port (default=8080)
+      ;   Port which should host the service on the remote server. This is what
+      ;   will get typed into web browsers or used by the reverse proxy. Should
+      ;   be > 1024. Also, /etc/ssh/sshd_config will need AllowTcpForwarding and
+      ;   GatewayPorts set to yes, then sshd will need to be reloaded.
+      ;     Example: http://example.com:8080
+      ;
+      ; tunnel_ssh_port (default=22)
+      ;   Port which the remote server exposes ssh.
+      ;     Example: ssh -p 2222 user@example.com
+      ;
+      ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+    state: present
+    create: true
+    backup: true
+    mode: "0644"
+
 - name: General | Account Management | Provisioning Configuration | General | Load
   ansible.builtin.set_fact:
     provision:  "{{ lookup('ini', 'enable     file={{gen_file}} default=false') | bool }}"
@@ -216,7 +265,11 @@
     prod_data_host: "{{ lookup('ini', 'prod_data_host   file={{gen_file}} default=hyperling.com') }}"
     prod_data_port: "{{ lookup('ini', 'prod_data_port   file={{gen_file}} default=22') | int }}"
     prod_data_user: "{{ lookup('ini', 'prod_data_user   file={{gen_file}} default=user') }}"
-    prod_data_dir: "{{ lookup('ini', 'prod_data_dir   file={{gen_file}} default=/srv/sftp') }}"
+    prod_data_dir:  "{{ lookup('ini', 'prod_data_dir    file={{gen_file}} default=/srv/sftp') }}"
+    tunnel_local_port:  "{{ lookup('ini', 'tunnel_local_port  file={{gen_file}} default=8080' ) | int }}"
+    tunnel_remote_host: "{{ lookup('ini', 'tunnel_remote_host file={{gen_file}} default=false')       }}"
+    tunnel_remote_port: "{{ lookup('ini', 'tunnel_remote_port file={{gen_file}} default=8080' ) | int }}"
+    tunnel_ssh_port:    "{{ lookup('ini', 'tunnel_ssh_port    file={{gen_file}} default=22'   ) | int }}"
 
 - name: General | Account Management | Provisioning Configuration | General | Boolean Check | Swap Block
   ansible.builtin.set_fact:
@@ -249,6 +302,10 @@
     - { 'prod_data_port': "{{ prod_data_port }}" }
     - { 'prod_data_user': "{{ prod_data_user }}" }
     - { 'prod_data_dir': "{{ prod_data_dir }}" }
+    - { 'tunnel_local_port': "{{ tunnel_local_port }}" }
+    - { 'tunnel_remote_host': "{{ tunnel_remote_host }}" }
+    - { 'tunnel_remote_port': "{{ tunnel_remote_port }}" }
+    - { 'tunnel_ssh_port': "{{ tunnel_ssh_port }}" }
 
 
 ## Workstation ##

tasks/general/settings/tunnel.yml

@@ -0,0 +1,68 @@
+---
+# 2026-10-17 Hyperling
+# Allow pushing a local port to a remote server automagically in a runit script.
+
+# ssh -N -p SSH_PORT -R REMOTE_PORT:localhost:LOCAL_PORT USER@REMOTE_HOST -v
+
+- name: General | Tunnel | Provisioned Variables
+  ansible.builtin.debug:
+    var: "{{ item }}"
+  loop:
+    - tunnel_local_port
+    - tunnel_remote_host
+    - tunnel_remote_port
+    - tunnel_ssh_port
+
+- name: General | Tunnel | Block
+  block:
+
+    - name: General | Tunnel | Facts
+      ansible.builtin.set_fact:
+        tunnel_service_name: tunnel
+
+    - name: General | Tunnel | mkdir | /etc/sv
+      ansible.builtin.file:
+        path: /etc/sv/{{ tunnel_service_name }}/log
+        state: directory
+        mode: "0644"
+
+    - name: General | Tunnel | mkdir | /var/log
+      ansible.builtin.file:
+        path: /var/log/{{ tunnel_service_name }}
+        state: directory
+        mode: "0644"
+
+    - name: General | Tunnel | Script | Run
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/run
+        content: |
+          #!/bin/sh -e
+          exec 2>&1
+          exec chpst -u {{ user }} ssh -v -H \
+            -R {{ tunnel_remote_port }}:localhost:{{ tunnel_local_port }} \
+            -p {{ tunnel_ssh_port }} {{ tunnel_remote_host }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Finish
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/finish
+        content: |
+          {{ runit_finish_sleep }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Log
+      ansible.builtin.copy:
+        dest: /etc/sv/{{ tunnel_service_name }}/log/run
+        content: |
+          #!/bin/sh -e
+          exec svlogd -tt /var/log/{{ tunnel_service_name }}
+        mode: "0755"
+
+    - name: General | Tunnel | Script | Log Config
+      ansible.builtin.copy:
+        dest: /var/log/{{ tunnel_service_name }}/config
+        content: |
+          {{ runit_log_config_10mb }}
+        mode: "0755"
+
+  when: tunnel_remote_host

test.yml

@@ -24,6 +24,9 @@
         - name: LLMs
           ansible.builtin.include_tasks: tasks/workstation/linux/software/llm.yml
 
+        - name: Tunnel
+          ansible.builtin.include_tasks: tasks/general/settings/tunnel.yml
+
     #######################
     #######################
     ###### / TESTING ######