ssh-public-ip.service

[Unit]
Requires=network.target
After=network.target
Description=SSH port forwarding to server with public IP

[Service]
ExecStart=ssh -o ExitOnForwardFailure=yes -o ServerAliveInterval=10 -o ServerAliveCountMax=1 -o UserKnownHostsFile=/home/pi/.ssh/known_hosts -i /home/pi/.ssh/id_rsa -N -R 5565:localhost:22 gholk@lab.gholk.ml

RestartSec=10
Restart=always

[Install]
WantedBy=network.target

# ## best practice
# * remote ssh server could enable GatewayPorts yes
#   ```
#   Match Group port-forward
#       GatewayPorts yes
#   ```
#
# * remote host need to be in `.ssh/known_hosts` or use option specify,
#   or ssh will prompt confirm because of **man in the middle**.
#
# * service should use its own key, and specify `command="nologin"`
#   in `.ssh/authorized_keys` for security reason.

# :.,$!sed 's/^\#//' | sh
# 
# port_local=22
# port_remote=5565
# remote=gholk@lab.gholk.ml
# 
# echo ssh -o ExitOnForwardFailure=yes \
#     -o ServerAliveInterval=10 \
#     -o ServerAliveCountMax=1 \
#     -o UserKnownHostsFile=/home/pi/.ssh/known_hosts \
#     -i /home/pi/.ssh/id_rsa \
#     -N -R $port_remote:localhost:$port_local $remote
#