Private machines hide their services behind routers and firewalls; sish gives those services a public address, reached with nothing more exotic than the SSH client already on your laptop. Point a standard remote forward at the server and a local web app appears at its own subdomain over HTTPS, ready to share with testers, clients, or a webhook provider. Raw TCP forwards work the same way, publishing a database, a game server, or an SSH port on a fixed external port you choose. Private aliases keep sensitive services off the public internet entirely, reachable only through an authenticated SSH jump from another machine you control. SNI routing passes encrypted TLS connections to the right backend by hostname, so several services share one public endpoint without the tunnel terminating their encryption. Aliases can spread traffic across multiple backends with built-in load balancing modes, handy when several replicas sit behind one name. The service console lists live tunnels and inspects forwarded requests as they pass, turning tunnel debugging into reading a log instead of guessing. Access rests on SSH keys or passwords with hot-reloaded key directories, and binding policies cap which subdomains and ports each user may claim. Because clients need no agent software, locked-down laptops, CI runners, and embedded devices can open tunnels with the tools already installed. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.