This is one of the core things I've been working towards with DNTLS [1]. I love the idea of tunnels, especially for sharing between private parties. The SaaS providers (Tailscale, Cloudflare, etc.) have done a good job making it really easy on their infra, but it really blurs the line of "self-hosted" to me. Ideally we end up with solutions like this that can be run entirely without an intermediary.

[1]: https://dntls.substack.com/p/the-new-internet

If self-hosted, then why do you need a third-party service *.ssh.luffy.cx ?