tunnels: optional remote_host forward destination (default 127.0.0.1)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/bridge/config.py

@@ -107,6 +107,7 @@ def _parse_tunnel(name: str, data: dict) -> TunnelConfig:
         reconnect=reconnect,
         health_check=health_check,
         direction=direction,
+        remote_host=str(data.get("remote_host", "127.0.0.1")),
         cert_command=cert_command,
     )
 

src/bridge/manager.py

@@ -29,9 +29,9 @@ def build_ssh_command(cfg: TunnelConfig, cert_path: Optional[Path] = None) -> Li
     """Build the SSH tunnel command (reverse -R or local -L)."""
     key = os.path.expanduser(cfg.ssh_key)
     if cfg.direction == "local":
-        forward_flag = ["-L", f"{cfg.local_port}:127.0.0.1:{cfg.remote_port}"]
+        forward_flag = ["-L", f"{cfg.local_port}:{cfg.remote_host}:{cfg.remote_port}"]
     else:
-        forward_flag = ["-R", f"{cfg.remote_port}:127.0.0.1:{cfg.local_port}"]
+        forward_flag = ["-R", f"{cfg.remote_port}:{cfg.remote_host}:{cfg.local_port}"]
     cmd = [
         "ssh",
         "-N",

src/bridge/models.py

@@ -51,6 +51,10 @@ class TunnelConfig:
     reconnect: ReconnectPolicy = field(default_factory=ReconnectPolicy)
     health_check: Optional[HealthCheckConfig] = None
     direction: str = "reverse"  # "reverse" (-R) or "local" (-L)
+    # Forward-destination host as seen from the remote end (direction "local")
+    # or from this workstation (direction "reverse"). Defaults to loopback;
+    # set e.g. a k3s ClusterIP to tunnel to an in-cluster Service.
+    remote_host: str = "127.0.0.1"
     cert_command: Optional[str] = None