SSH Tunnel

If Kyber is running on a VPS or remote server, you can access the dashboard securely from your local machine using an SSH tunnel. This is the recommended approach — it keeps the dashboard bound to 127.0.0.1 on the server and doesn’t require exposing any ports publicly.

How it works

An SSH tunnel forwards a port on your local machine to a port on the remote server through an encrypted SSH connection. When you open http://localhost:18890 in your browser, the traffic is tunneled to the dashboard running on the server.

Quick start

Run this on your local machine (not the server):

ssh -L 18890:127.0.0.1:18890 user@your-server

Then open http://127.0.0.1:18890 in your browser and enter your dashboard token.

That’s it. The dashboard is now accessible locally as if it were running on your machine.

Custom ports

If you’ve configured a different dashboard port on the server, match it in the tunnel command. For example, if the dashboard runs on port 9000:

ssh -L 9000:127.0.0.1:9000 user@your-server

You can also map to a different local port if 18890 is already in use:

ssh -L 8080:127.0.0.1:18890 user@your-server

This lets you access the dashboard at http://localhost:8080 while it runs on 18890 on the server.

Tunneling both gateway and dashboard

If you need access to both the gateway API and the dashboard, forward both ports:

ssh -L 18790:127.0.0.1:18790 -L 18890:127.0.0.1:18890 user@your-server

Background tunnel

To run the tunnel in the background without opening an interactive shell:

ssh -f -N -L 18890:127.0.0.1:18890 user@your-server

To stop a background tunnel, find and kill the process:

# Find the tunnel process
ps aux | grep "ssh -f -N -L 18890"
 
# Kill it
kill <PID>

SSH config shortcut

If you connect to the same server frequently, add a host entry to ~/.ssh/config:

Host kyber-vps
  HostName your-server-ip
  User your-username
  LocalForward 18890 127.0.0.1:18890
  LocalForward 18790 127.0.0.1:18790

Then connect with just:

ssh kyber-vps

Both tunnels are established automatically.

Persistent tunnel with autossh

For a tunnel that reconnects automatically if the connection drops, use autossh:

# Install
brew install autossh    # macOS
sudo apt install autossh  # Debian/Ubuntu
 
# Run
autossh -M 0 -f -N -L 18890:127.0.0.1:18890 user@your-server

-M 0 disables the autossh monitoring port and relies on SSH’s built-in ServerAliveInterval instead. Add these to your ~/.ssh/config for reliable keepalive:

Host *
  ServerAliveInterval 30
  ServerAliveCountMax 3

Troubleshooting

“Address already in use” — another process is using the local port. Either kill it or use a different local port:

ssh -L 8080:127.0.0.1:18890 user@your-server

“Connection refused” — the dashboard isn’t running on the server. SSH into the server and check:

kyber dashboard  # start it manually
# or check the service
launchctl list | grep kyber  # macOS
systemctl --user status kyber-dashboard  # Linux

“Permission denied” — make sure your SSH key is set up for the server, or use password auth:

ssh-copy-id user@your-server

Security notes

• The tunnel encrypts all traffic between your machine and the server
• The dashboard stays bound to 127.0.0.1 on the server — no public exposure
• No need to configure allowedHosts or change the dashboard bind address
• The dashboard auth token is still required — the tunnel only handles transport