SSH tunnels from first principles – with a working self-hosted setup (arvindparekh.me)

Built this out of my self-hosted VPS setup. Covers local and remote forwarding, the GatewayPorts gotcha, bastion hosts, and why ngrok is essentially just remote port forwarding with a reverse proxy in front.