@kawaiipunk yep same idea that wiki page just talks about how to make it "clean" , run as a systemd service unit with its own isolated ssh known hosts file and what not. Iirc you can also set the tunnel users login shell to some program that hangs forever if you want to prevent the tunneler from being able to run commands on the server.