Self-configuring reverse-proxy gateway on AWS for LAN services exposed via SSH reverse tunnels over TLS.
- Single t4g.nano (ARM64) spot instance running nginx + acme.sh DNS-01 TLS termination
- AMI built with Packer; runtime config (domain, services, ports) in SSM Parameter Store
- Instance updates its own Route53 A records and renews certs at boot — survives spot terminations
- Infrastructure managed by OpenTofu; see
PLAN.mdfor migration spec