Unstable Muffin

Top Chef S23E04 - Pick a Side

2026-04-25T00:00:00-07:00

I’m so deeply behind on posting these reactions posts, but I guarantee the reactions are still fresh because I write them down in my notebook as I watch the episode. Writing this post will just be me reliving the episode with you through my notes. Should be fun!

This episode, we recovered from the flop-tastrophe from last week and into another week of the chefs all performing pretty well! We’ve got some awkward cross-promotion in the quick fire, Justin committing fashion crimes, and an elimination challenge brief that just doesn’t make any sense and seems to be judged wildly inconsistently. There’s also a major cooking disaster that the edit desperately tries to make us blame the chef for, but is so clearly not their fault that it comes off incredibly disingenuous. This week, drama is the main course.

Quick Fire

Okay miss try-too-hard. Cheering for the guest judge like a teacher’s pet. Idk if you think you’re being clever but everyone can plainly see you’re sucking up.
I wrote this in my notes: “‘Big Josh fan’ – girl same” but I have no idea what that was supposed to mean. But it feels important, so I’m leaving it in.
They’re talking up Josh wines as if it’s this super exclusive, premium wine, which makes sense since they’re the sponsor for this episode. But my association with Josh wines is watching the same ad fifty billion times on Hulu and seeing it on the cheap end of the Safeway wine aisle, so something’s not matching up here.
SNEEZE-GATE 🚨🚨🚨
Dang, there’s a lot of money flowing this season. Can’t say the chefs don’t deserve it though, so I’m happy about it.
How many different “ways” are there to do cheese? It’s just cheese!
Eggs just don’t seem like a star ingredient to me. Idk how they’re going to make a stand-out dish with eggs. What are you going to do, fry it in truffle oil? Scramble it with a gold leaf?
Justin looks like he’s either bored out of his mind or on the verge of falling asleep. Possibly both.
Okay, the twins have been officially added to the hate-list. Not above Justin, but definitely in the “egregious” tier.
MOCHI-GATE 🚨🚨🚨
Soft scrambled eggs are just undercooked eggs. Fight me.
I want to try Tomme cheese ☹️ It looks and sounds so delicious for some reason. Maybe I’m just hungry.
“You just cook whatever you want and I will pair the wine to your food, instead of the other way around.” – So, the literal exact opposite of this challenge?
Oof, these mochi balls are looking crusty af.
Boo Justin, yay Jennifer

Elimination Challenge

“There’s no catch” Kristen says, looking slyly at the camera. She’s in her villain era and the chefs know it lol
I don’t understand this “make a side dish a main dish” nonsense. What even is the difference between a main dish an a side dish? The show never explains. Jonathan even said “you can’t just make a bigger plate of collard greens and throw a protein on it and call it a day” which is exactly what I would have done if given this challenge, but then nobody ever explains what you should do instead.
CABBAGE-GATE 🚨🚨🚨 Where’s the brotherly love now, twins?!?
What is this okra play? Seems unwise to me. Literally two of the judges have openly said they don’t like it. Why would you take that on, they’re literally giving you an out.
It’s never easy on Top Chef. Of course you’re also serving an entire diner full of guests. For some reason.
I must admit, I don’t understand the staggered service here. You get ninety minutes to cook for the judges, and then ninety more to cook for the rest of the restaurant? What’s the incentive to not phone it in for the restaurant cook? The judges have already tried your food, you’re not going to get docked points if your food tastes like crap to the rest of the diners. This one doesn’t make sense to me.
Jonathan hates turkeys? HE’S A TURKEY RACIST??? He loses Thanksgiving privileges. Get him out of here.
“Main Dish Energy” is very funny, ngl 😆
“Maybe I can fool Tom into thinking he likes okra” – Stop. You can’t fool Tom. You’re embarrassing yourself.
Did anyone else see Brittany just drop some greens on the grocery store floor, and then just pick them back up again and put them in her cart??? Where is my fainting couch, I think I caught the vapors.
SHE’S NOT YOUR BABY?!?!?!?!?!?
The little video messages between Sherry and her son are so sweet ❤️ Sometimes the “messages from home” segment can feel really forced and awkward, but these are really organic and really bring the viewers into the world of the chefs. I really like it. It highlights the sacrifices the chefs have to make to be on this show, and makes the whole competition feel that much more real and the stakes that much higher.
WHAT?!? DAISY DUKES?!?! WHY?!? WHY ARE YOU CUTTING THEM WHILE YOU’RE WEARING THEM?!?! WHY IS THIS HAPPENING. WHY ARE THE PRODUCERS LETTING THIS HAPPEN
This is teleporting me back to the shaved head incident from season 1.
Bacon milk? Who’s out here milking bacon? Someone call PETA.
What is this cooking lamp thing? It’s freaking me out
Justin is half-Indian, whole-idiot.
Justin was not bullied enough through middle school and high school, and it shows. Society should have never let these booty shorts happen on him.
Justin is a horse confirmed? (This is way too many bullet points about Justin; it is becoming right on the verge of cyber-bullying)
NO STEAM-GATE 🚨🚨🚨
Genuinely, what do you do in this situation though? The ovens are supposed to be pre-heated before the chefs start cooking, so it’s obvious that Brittany thought the steamer would be on already when she put in her food. But clearly it wasn’t on, whether that was an oversight or technical restriction (I have no idea how a steamer works, but maybe it can’t be turned on before it’s used for some reason) so it doesn’t really feel like this flub is the fault of Brittany’s which makes it all the more tragic that her dish is essentially ruined because of it.
Is it me or is the fashion off the charts this season? That’s not something I typically notice but every time somebody’s not in a chef’s coat (besides Justin’s ridiculous shorts) I’m like “damn that’s a sharp outfit”
“Justin’s [dish] is a little lackluster” – That’s because Justin is lackluster.
“Scallion Cream” sounds horrendous, I’m sorry. What is it, whipped cream with scallions in it? Eugh.
Brittany PUSH!!!
It feels insulting to be judged and then turn around and have to cook some more for some other nobodies that won’t affect your score at all.
WHERE IS THE POT LICKER??? I see the fritter but WHERE’S THE POT LICKER
Honestly, Tristan whispering “never admit that” when she was talking about her cooking woes really irked me. She had some disasters when creating her dish, and hiding them from the judges will only make them think that the dish she served was the way she intended to serve it, which is not at all the case. Plus, why lie to the judges? That will only make them mad at you trying and failing to lie to them, or them eventually figuring out you lied and they hold that against you. It’s just a bad idea all around, and makes me majorly cringe that Tristan implied that you should lie to them. The only thing I would have done differently from Brittany is being upfront that the cooking instrument that you thought was on was not on, but I feel like I remember in past seasons Tom responding to that with “why didn’t you double check then” which really just skirts around the whole issue of production supposed to be having those machines turned on and pre-heating already. This feels like a massive run-on sentence but I will not be editing it.
There’s that frickin’ bacon cream again. Why are people making savory whipped creams? LEAVE IT ALONE!!!
Is Duyen the new frontrunner???
Duyen: “hmm. cool.” lol what a way to react to someone saying they thought their dish was great. She new he flopped
Sieger looks like such a douchebag in every era. Every single one of his childhood photos, he looked like the quintessential douchebag of that decade lol Including this one! I might add
There is nothing more cringe-y than somebody complimenting themselves on how they look.
Fromager D’Affinois is the most pretentious sounding ingredient I’ve ever heard. And I’ve watched 23 seasons of Top Chef.
At this point in the episode I made a note that I was literally falling asleep as I watched, so the quality of the remaining reactions may falter. I don’t know if they’ll get shorter or exponentially more unhinged. Let’s find out together.
Pause for the Voss glamour shot. Not in any way distracting from the episode flow at all.
Kinda peeved that the okra gamble paid off. But that feels like a personal grudge.
SHE ONLY HAD TWENTY MINUTES TO COMPLETELY REINVENT AND RECOOK HER ENTIRE DISH!!! STOP BLAMING BRITTANY FOR THIS!!! “Didn’t know how to pivot” my ass
oh no :( poor brittany
I feel like she could do really well in Last Chance Kitchen. She can build her confidence there.

How To: Migrate a PostgreSQL database

2026-04-21T00:00:00-07:00

This article will show you how to migrate a database from one PostgreSQL server to another.

Before starting the database migration, stop the service that is accessing the database to prevent a corrupt backup and/or missing data. This should also flush any cached data to the disk.

On the old server

Dump the database contents from the old database to a file.

pg_dump [-h <ip_address>] -U <user> -d <database> -f <backup_file>.sql

pg_dump – This is a PostgreSQL utility command that dumps all the data from a PostgreSQL database to a file. This includes not only the data but also indexes, schema, autoincrement states, and everything else that represents the state of the database at the time the backup was made.
-h <ip_address> – This specifies where to find the PostgreSQL database to dump from. If this command is run on the same machine as the database, it can be omitted and will default to the current machine.
-U <user> – This is the username of the SQL user to access the database. Make sure it has permissions to access the database.
-d <database> – The name of the database to backup.
-f <backup_file>.sql – This specifies the name of the file to dump the database to. Note that the output of this command is plaintext SQL statements, so the file extension should be .sql.

The contents of the backup file is plaintext SQL, so you can view and modify the backup if desired. This can be helpful to adjust usernames, database names, and permissions if you want them to be different on the new server than the old one. When the backup is restored, it will execute every line in the file one-by-one to recreated the database. Any changes to the backup will be executed as well.

On the new server

First, connect to the new database.

sudo -u postgres psql

Create the database user.

CREATE USER <db_user> WITH PASSWORD '<password>';

Create the database.

CREATE DATABASE <db_name> OWNER <db_user>;

Finally, grant the new user all permissions and privileges on the newly created database.

GRANT ALL ON SCHEMA public TO <db_user>;

Once the user and database are created in the new server, you can exit the PostgreSQL command line (\q). The next step is to configure PostgreSQL to allow access to the new database for this user. Open the access configuration file for PostgreSQL in any editor.

sudo nano /etc/postgresql/<version>/main/pg_hba.conf

And add a line like the following:

# TYPE   DATABASE        USER            ADDRESS            METHOD
<type>   <database>      <db_user>       <ip_address>       <auth_type>

<type> – This specifies the type of connection. Valid options include local, host, hostssl, and hostnossl. local is for connections over the PostgreSQL Unix socket. host is for TCP/IP connections (either remote or via localhost). hostssl and hostnossl are for specifically TCP/IP conections that are required to have SSL encryption or not.
<database> – This is the name of the database this record allows access to.
<db_user> – This is the user that is being allowed access to the above database.
<ip_address> – This is the IP address from which the specified user is allowed to connect to the specified database. The format should be IP address and subnet. A subnet of /32 corresponds to a single IP address, so something like 127.0.0.1/32 would correspond to only allowing connections from localhost over IPv4. For access from Docker containers, which have dynamic IP addresses, you should whitelist the entire Docker subnet: 172.22.0.0/16.
<auth_type> – This is the type of authentication required for this method of access. Options include trust, reject, md5, password, scram-sha-256, and peer, among others.
trust will implicitly trust this connection and not require any authentication at all.
reject will reject this connection. This is useful in conjuction with other records, which allow you to fine tune access. Records are evaluated from top to bottom and terminate on the first match, so you can reject a specific IP address at the top of the file, and then accept a broader range of IP addresses lower in the file.
md5 will accept a password with SCRAM-SHA-256 or MD5 hashing algorithm. MD5 is easily cracked with modern machines and is not considered secure. This authentication method is deprecated and will be removed in future version of PostgreSQL.
password requires the client to send their password unencrypted to the server. The password is transmitted in cleartext, so this authentication method is not recommended on untrusted networks.
scram-sha-256 will required strong encryption for the password.
peer authentication will check if the user connecting has an OS account that matches the name of a database user. If so, it will allow the connection. This authentication method is only valid on local connection types.

If you intend to allow connections from other devices or networks, you must change PostgreSQL’s configuration to bind to all network interfaces. By default it is only bound to localhost, and connections from another network (e.g. another computer or even Docker running on the same machine) will fail.

To configure PostgreSQL to bind to all available interfaces, modify the config file at /etc/postgresql/<version>/main/postgresql.conf and change the following line:

listen_addresses = '*'

After saving the changes to the configuration, trigger a reload to force PostgreSQL to update its configuration. If you changed the listen_addresses config, you must restart the PostgreSQL service instead of just reloading it.

sudo systemctl reload postgresql

Finally, restore the database backup to the new database.

psql [-h <ip_address>] -U <user> -d <database> -f <backup_file>.sql

psql – This is the command that connects to a PostgreSQL server.
-h <ip_address> – Host of the new database server. If the backup file was copied to the new server and this command is being run on the same device as the database being restored to, this can be omitted.
-U <user> – The username to connect with. Should be the same as the old one.
-d <database> – The database name. Should be the same as the old one.
-f <backup_file>.sql – The file containing the backed up data created from pg_dump.

Now the data should be restored to the new database. Point the service to the new database and start it up, and it should connect and appear that nothing has changed.

Top Chef S23E03 - True Colors

2026-03-29T00:00:00-07:00

It’s episode three, and the gloves are coming off. We were riding high last episode, but everything that goes up must come down. We had a deeply unappetizing quick fire, and barely anyone met the brief for the elimination challenge. The judges are fed slop and are mad about it. Jennifer has fallen out of a tree prior to filming and now has to compete with an injury. It’s a flop-fest for the ages, and I’m living.

Quick Fire

“You poor thing.” – She is not a wounded animal, Justin. Have some freaking empathy for your wife.
Shout out to Rhoda killing it 👏👏👏
These brothers are gay af. Hiding their cooking show like it’s some sort of deep rooted shame. I don’t care if they have wives, we know the truth.
Livermush? Really? Talk about an unappetizing challenge. And I wouldn’t call it “iconic”; I’ve never heard of it.
One of my favorite moments from this episode is Emeril Lagousky being shocked at how much money the winner of the Quick Fire will win lol He’s been on Top Chef since 2009, so he knows how much previous winners walked home with 😆
SCRAPPLE?!? That’s not real. You cannot convince me that’s real.
NO, NOT JENNIFER 😩😩😩
Justin is totally unbothered by his wife’s condition. He is continuing to cook unperturbed.
Why is there a monopoly on wins this season? Laurence winning both quick fires are Rhoda winning both elimination challenges?

If you ate a “liver spread” growing up, I think that qualifies as child abuse.
“I hope you all de-liver!” – That was a weak-ass pun. Up your pun game, people.
Nana is failing again. 🤦‍♂️
“I got stuff on the plate 😃” – Never change, Nana. Never change.
What is everyone laughing at? There was no joke.
At least Laurence’s reign of terror is over for the Quick Fire.

Elimination Challenge

Edible garment challenge when???
I love a competitor that immediately chooses to ignore the brief and do something else. That always works out for them, definitely.
I actually love this challenge! It’s like if Instagram food had to taste good.
My poor Jennifer ☹️
Justin seems annoyed that his injured wife is calling him, and it’s up to the other contestants to fill her in on what the challenge is. Are we sure he even likes his wife???
“Psychedelic ceviche. We’re going acid trip.” – More drugs. This season is obsessed with drugs.
Nana? Not good with time management skills? Say it isn’t so.
I love Oscar’s minigame at the checkout register! I feel like it should be integrated into the show somehow.
Justin was bad at school? No wonder he’s dumb af
Black pork? There’s a reason nobody has ever heard of that.
Whole Foods does not sell chlorophyll. Where is he getting these potions and tinctures?
None of the jokes this episode are funny. If the chefs are this unfunny we should just edit it all out at this point.
BAO-GATE 🚨🚨🚨
What is activated charcoal? Which begs the question, what is unactivated charcoal? How does one activate charcoal?
We all know Jennifer’s dough is not going to rise tomorrow.
Matching pajamas? Face masks? Mean Girls.
He’s finger painting
STUFFING-GATE 🚨🚨🚨
Love Brittany ❤️
Why is there so much grunting this episode?!?
Nana & cooking everything twice; name a more iconic duo. I’ll wait.
“Take your time. Food is good.” – Girl you don’t have time, that’s your problem!
CHINESE ROCK BAND?!?!?!? Badass alert. 🚨🚨🚨
SABOTAGE?!?
oh no, nana :/
She only gets so many changes, though.
“She stresses me out” –Aaron
“It’s not the first time. 😐” – Ouch.
Brandon is trying his best to salvage the situation, but what is there to really say when the chef puts themself into this position over and over and over again.
That pork looks shat upon
That mole looks beautiful 😍
“Hopefully it’s edible” – I’ll take “Things You Shouldn’t Say to the Judges When Presenting Your Dish” for 600, Alex.
Isn’t mole something you eat with something else? Like a tortilla or something? It looks like they have to eat it like a soup, which doesn’t sound appealing.
If Nana gets a free pass because Jennifer has to leave the competition due to her injury, I’m gonna freak out. Not like a cute little freak out, like FREAK. OUT.
The color lady is correct, unfortunately.
I demand Jennifer come back for another season.
“This is my cochinita pork” – What did he just call me?
“Bao. Bao bao bao. Bao bao bao. Bao bao.” – …what.
Oh, I suppose the chlorophyll may have been provided to the contestants for this particular challenge. That makes sense.
That is a beautiful scallop.
COLOR-GATE 🚨🚨🚨
“That thing is white as white can be” – Wow, they’re talking about me 🤩
“Very hot! And I’m not talking about the pot!” – Heck yes, Sherry can GET IT!
What the actual heck, is that a pot of bloody fingers?!?
“It looks like an ice cream sandwich and puked up code slaw.” –Aaron (And I can’t disagree with him)
“Lamb and clams” needs to die a horrific death. It’s like if Surf ‘n’ turf had an uglier, stupider sister.
She KISSED it on the grill?!? Is that sanitary?!?!?
“Every single thing tasted really good.” – Did it though?
Last week everyone did so well, and this week everyone is flopping. Like, MAJOR flop-ageddon.
“Don’t say that please” 😬
OVERTHINKING-GATE 🚨🚨🚨
oh no, Tom is getting grumpy ☹️
What on earth was Oscar’s movie reference? That made literally no sense.
“Rhoda’s dish looks like an oil spill” –Aaron
“That might be the least colorful ceviche I’ve ever seen in my life” – Savage. Accurate, but savage.
“Gray parsnip” is my new favorite insult.
The judges want blood, and I want to see them have it.
Laurence has to stop winning. Somebody stop him.
They want to talk to EVERYONE ELSE?!? Hot diggity.
Eliminate them all.
It was flaccid.
NANA HAS DIED
That was abrupt.
She’s going to fail miserably in Last Chance Kitchen. She can’t time anything, and that’s a major component of LCK.

Top Chef S23E02 - Puckerbutt

2026-03-23T00:00:00-07:00

We’re back with another episode of Top Chef. Things are heating up (literally and figuratively) and personalities are starting to clash. The bonds that were once so tightly knit are starting to fray in the heat of the kitchen. (I’m going full cliché, deal with it.) Favorites are beginning to emerge from the pack, while others are starting to feel like they’re running out of runway. The editing has gone avant-garde, for some reason. Despite my best efforts, Justin is still here. Let’s jump into it.

Quick Fire

Could you imagine growing up on a psychedelic milk farm? Feels like the premise of a horror game.
They’re COMMITTED to elevating the gelato experience. COMMITTED!!!
I still HATE the married couple. *retch*
Please don’t call the other contestants “babe”. It’s making everyone uncomfortable. Now is not the time to try out your gay friends’ slang. This is not allyship; it is appropriation.
Guys, he feels good about it. Time doesn’t matter because he feels GOOD about it.
If there’s anything I’ve learned from watching 22 seasons of Top Chef, it’s that a lingering shot of the grill means there’s gonna be some drama later. Mark my words.
Okay, I’m about to say something controversial. Yes, I still hate the couple. ~But~… Jennifer (the wife) is starting to grow on me a little bit? She seems cool. I KNOW I KNOW PLEASE PUT THE PITCHFORKS DOWN I’M SOR–
Called it. That pork tenderloin is TOAST (pun abso-freaking-lutely intended)
NO STOP IT WITH THE “my boo 😘” AUTOMATIC DISQUALIFICATION, CUE THE SNIPERS
HE DJS?!?!?!?!?
The pork was too thick =(
RAW PORK-GATE 🚨🚨🚨
“I plated up!” – God I love Nana so much, she’s a fighter and I will die for her. SHE BETTER MAKE IT FAR, DON’T LET ME DOWN NANA
I don’t think I understand what a “garnish” is, because I thought it was a little inedible thing that sat on the side of the plate to make it prettier. But these people are calling entire components of the dish “garnish” and I am severely confused. Parsley is a garnish, not a custom made coffee-chili pickle that contains the highlight ingredient of your dish.
“Oh, gelato in the sauce? 🤨” – When will these people learn to FOLLOW THE BRIEF!!!
“Mostarda” sounds like a slur

Elimination Challenge

I cannot believe they’re allowed to say “pucker butt” on national television. This has to be an oversight.
No spice fam represent! Thank you Jassi, I see you. Except, you know, I’m almost offensively white so nobody questions it when I order -1 out of 5 spiciness. But regardless, it’s nice to see my spice-intolerance represented on a culinary show.
I do like the concept of this challenge a lot, where each dish has to be spicier than the last. It really forces the competitors to work together at each step of the competition from menu creation to execution to plating to make sure each dish is spicier than the last. It’d be so incredibly easy for a dish to get way too spicy, and then you have to choose between having a dish out of order or to ramp up the rest of the dishes spiciness at the last second, risking getting too spicy or throwing the dish out of balance. There’s a lot to think about in this one and I don’t think the editing does it justice.
Surprise twin appearance! I don’t blame him; I, too, combine them into a single person when they’re not on screen together. There’s simply nothing to differentiate them yet.
This editing is so over the top lol I don’t hate it but it’s so out of left field for Top Chef. I can’t tell if they’re trying to court the TikTok generation with some loony edits, or if they’re just trying out a looser, less serious editing style for this season. I guess only time will tell which one they’re going for and if it works or not.
Why is this episode so drug heavy??? First the psychedelic milk farm, and now pepper induced hallucinations! What’s next, a Quick Fire challenge with marijuana???
What on earth is she crab soup?? Has feminism finally gone too far? It’s just a crab, why you gotta gender it? Did you ever think it could be they/them crab soup? Of course not. You only think of yourself.
GROCERY PRICE-GATE 🚨🚨🚨
Red team is totally going to run out of ingredients. They’re all kumbaya about sharing ingredients now but when they’re in the kitchen fighting over the last arugula they’re not going to be so Mother Theresa about it.
Guest appearance by my husband when Justin was totally unbothered during grocery price-gate: “Sounds like somebody has kids”
The music supervisor is really popping off this episode with that sick transition between classical and rock music. Emmy material.
“Emulsion” is such a sexless word. You can’t say it without really deflating the entire room.
Somebody just called “spicy boy Oscar” sexy and I want to vomit. What is wrong with these sickos?
Chicken wings, Justin? This man is such a child.
Motherly = bully? Lol
RESPICE-GATE 🚨🚨🚨
“I’m not going to re-season it again 😤” – How very motherly of her
Tom Colicchio is immortal and you can’t change my mind about it.
“I don’t sous vide often, but … I don’t want to just sear any fish.” – I’m calling it: this is going to be one of the most fucked up fish we’ve ever seen.
I do not understand the critique where they call something “boring but delicious”. What are you going for here? Was it bad or was it good?
Jassi is just so happy to be here and I love that for him lol
Please stop saying “butt pucker” I’m begging you 😭😭😭
Everyone is doing so well! I love to see it. It’s always a good episode when the judges have to nitpick between the top and the bottom because everyone did so well.
Oh, I get it. This is just Top Chef Hot Ones.
Did I call it or did I call it?! THE FISH IS NOT COOKED PROPERLY! STOP SABOTAGING YOURSELF NANA!!!
“This is where you start sucking in the air” – Really? This episode is the Yucky Words Hall of Fame. They’re going to start describing dishes as moist.
I don’t know how many more ways I can say this, but Justin is the worst.
They just described Justin’s dish as “flabby” which I think describes his personality as well.
Elimination prediction: Bye bye Jassi
Although Nana has to stop fucking up because thin ice doesn’t even begin to describe what she’s skating on.

Top Chef S23E01 - Carolina Roots

2026-03-22T00:00:00-07:00

Welcome to the personal section of my blog, where I write about things I care about with zero regard for facts or feelings. We’re kicking it off with a series I’ve decided to call Top Chef Reactions. No recaps, no analysis, just a real-time, unfiltered stream of consciousness from the dark recesses of my brain as words and pictures flash in front of my face. We’re starting with the currently airing season 23. There is drama. There is heartbreak. There’s somebody I want to hit over the head with a crudités. Let’s get into it.

Quick Fire

“I’m not here to play patty cake!” – Well thank god somebody said it. I was starting to think everyone was here to play patty cake. Could you imagine? A season of all patty cakes? Disgusting.
Has it been too long since I’ve watched Top Chef or does there seem to be an unusually high amount of unearned confidence in this season’s cast? So many people are sure they’re gonna win. Like, relax. You’re all going to fail soon enough.
“Five star, five diamond [restaurant]” – Okay, hold on, record scratch. Five star five diamond? I don’t think we’re talking about Michelin stars anymore, because I think those only go up to three. Are you just bragging about your restaurant’s particularly good Yelp rating? And don’t piss me off with this “five diamond” bull crap. You’re just making stuff up now.
Hate the couple already. Annoyance meter is through the roof.
I just feel like I need to address the elephant in the room: Kristen is a baddie and Gail still makes me question my sexuality. There is no reason these women need to go so hard and yet here we are. Bravo continues to bless us with women who eat (literally) and leave no crumbs (figuratively).
Some challenges on Top Chef can be quite heavy handed and (dare I say it) a little forced, but I really love the twist for this first Quick Fire. Not having a real clock and having to time your cook based on cars racing around the track is a great way to test the chefs’ ability to stay flexible with timing. I’m not sure if they were given a rough estimate of how much time it would take, but I hope they weren’t and had to speed up and/or slow down based on how much they over/underestimated the speed of the cars. I’ve always preferred these types of “time twist” challenges to come later in the season once the contestants have gotten accustomed to the time crunch, but for the first Quick Fire right out of the gate, this was pretty fun to watch.
Of course Justin, the dunce of the season, falls immediately as soon as the game begins. Incredibly on brand.
The YouTube chef is incredibly awkward on camera. Maybe I can give him the benefit of the doubt and assume the producers got one of the worst clips they could find of him, but dang. For someone who’s job it is to be charismatic on camera, he made me cringe so hard I folded in on myself.
HUSH PUPPY-GATE!!! HUSH PUPPIES ARE TOO SHRIMPY!!! 🚨🚨🚨
HUSH PUPPY-GATE UPDATE: Flour has saved the hush puppies. We have narrowly avoided our first Top Chef disaster.
I am deeply confused on why they can’t plate until the final lap. That seems like producer shenanigans to me, trying to force timing drama on the contestants when it doesn’t need to be there.
KALE-GATE!!! KALE-GATE!!! WE ARE MISSING KALE ON SOME PLATES!!! 🚨🚨🚨
RAW FISH-GATE!!! RAW FISH-GATE!!! WE HAVE RAW FISH AT THE JUDGE’S TABLE!!! 🚨🚨🚨
Oh look, Justin is on the losing team. Raise your hand if you’re surprised. Oh look! No hands.

Elimination Challenge

Ugh, I hate sweet potatoes. Truly THE disappointment of the potato family. Let’s get this over with.
ONE HOUR?!? That’s….not enough time to do anything! I can’t even get all the ingredients out of my cupboard to prep for dinner in an hour! Is this the fast food season of Top Chef? Make it make sense.
Also, what’s up with this no-Last-Chance-Kitchen-for-the-first-two-eliminated-chefs business? They need two eliminated chefs to compete, so does that mean no Last Chance Kitchen until episode 4? Why do they suddenly hate Last Chance Kitchen so much? Is Tom Colicchio tired? Get him a co-host! There are solutions to these problems people! WE WANT LAST CHANCE KITCHEN
Okay so there’s definitely some relationship issues going on with Justin and Jennifer? Justin is saying she “won’t let him put a ring on it” and Jennifer is saying “I’d say yes if he proposed”? This is either some crazy editing or there is major trouble for these “life partners” ahead. I cannot wait for this to explode on live television. Either way, they’re still pissing me off.
I still think it’s crazy that these chefs are let loose in a public Whole Foods on a time limit with random civilians just trying to buy groceries for their families. Laurence literally body slammed a random lady with his cart. Let the people shop in peace! They didn’t ask to have a reality competition thrust upon them on a random Tuesday afternoon! At least close down the store for an hour or something. It seems extreme.
My gosh, these people are cutting and chopping potatoes with reckless abandon. PLEASE DON’T CUT YOUR HANDS OFF 😭😭😭
BLOW TORCH BITCH COMING THROUGH ANYBODY GOT A BLOWTORCH??? 🔥🔥🔥
YAAAAAS Nana with the 30 minutes dance! More of this please
THE OVEN WAS NEVER ON-GATE!!! THE OVEN WAS NEVER ON 🚨🚨🚨
The judges power-walking to the restaurant as a group was one of the hottest things I’ve ever seen. It’s doing to me what The Fast and the Furious franchise probably does for straight men.
Ice cream? When it’s a thousand degrees out? Bold. Reckless, but bold.
I finally looked up what ~~herbs de Provence~~ was, only to find out it’s just pretentious Italian seasoning.
TIME-GATE TIME-GATE TIME-GATE 🚨🚨🚨
OH NOOOOOOOOOOOOOOOOOOOOO
She didn’t finish on time ☹️
Babes, relax. It’s just a TV show. Take some deep breaths.
Okay, look. I’m going to be real with you. One of the main reasons I love reality competition shows is to watch people have complete mental breakdowns on my TV. It’s why I love The Traitors. But I give huge props to Nana for having her freak-out moment, and then pulling herself together and presenting her dish to the judges. The show is designed to make you fail. It’s designed to be a pressure cooker of stress and emotions, with cameras everywhere looking for the cracks to begin to show in your facade. Many a chef has had a major blow-out on Top Chef. It’s part of the game. But Nana really rallied herself, with the support of Kristen and the other chefs, and did her best to present her dish, flaws and all. She didn’t give up and she didn’t shrink away. And that’s what I will eventually remember her for. Not the mistakes, but how she pulled through and came out a better person and chef. It’s made me really like her and want to root for her for the rest of the show.
Who’s out here inventing new potatoes? We have enough potatoes. Leave the potatoes alone.
“It was just a crazy-brazy kind of dish” – Automatic elimination.
BOTH of the twins in the top? Stop torturing me.
I really hate Justin on a deep, personal level.
She’s serving under-cooked pork? Couldn’t that literally kill people? Girl microwave it or something, my god.
PORK-GATE PORK-GATE 🚨🚨🚨
Medium-rare? Girl, be serious.
I ❤️ Rhoda
What the hell is cane vinegar?
I ❤️ Duyen
YAY ROHDA ❤️❤️❤️
Still mad about no Last Chance Kitchen. Budget cuts? There’s like a thousand spin-offs of Top Chef, you can afford two episodes of LCK.
Sad for Day ☹️ It’s hard to see her go, especially when I don’t think she did particularly awful for a first episode. But when it comes right down to it, none of her components were really successful or even necessarily good, so the decision seems justified.

How To: Install Steam mods on Linux

2026-03-18T00:00:00-07:00

When you install a mod for a Steam game on Linux, it may not work correctly in the game. In many cases this is due to the differences in the way Windows and Linux interpret file names. In Windows, file names are case-insensitive, meaning MyFile.txt and myfile.txt refer to the same file on the disk. In contrast, on Linux file names are case sensitive, so those two file names would refer to different files.

Since Windows dominates the gaming scene, most mods are developed on Windows computers, where the casing of file names doesn’t matter. This leads to modders getting lazy with their filenames and often using a different casing than the game uses. While the mod might work without issue on Windows, on Linux the mod will fail in unexpected ways when it tries to reference files that may or may not exist (at least, as Linux sees them).

The solution to this problem is to install a virtual file system on your Linux computer that will emulate a Windows file system with case insensitive filenames. When the mod loads files from this virtual file system, it loads files with any casing correctly while the game itself continues natively on Linux. The steps below will show you how to create the virtual file system and then mount it for use with your games. You don’t have to reinstall your mods this way either; they can be copied over to the new file system and should start working immediately.

Create the virtual file system

To start with, you need to create the virtual file system. We will be using the vFAT file system for this purpose. vFAT is a lightweight, Windows-compatible file system with native support in the Linux kernel. It’s significantly faster to use compared with a full NTFS file system, since NTFS provides a bunch of features that are not needed for a small virtual file system and it requires additional driver support in Linux.

To create the virtual file system, run this command:

sudo mkfs.vfat -C -F 32 /opt/steam-workshop.img 2097152

mkfs.vfat - This command creates a virtual file system using the FAT file system format.
-C - This option specifies that the command should create a file instead of using an existing physical device like a USB stick.
-F 32 - This option specifies using FAT32 format, allowing the largest file sizes in the FAT family.
/opt/steam-workshop.img - This specifies the file where you want to file system to be stored. This can be any place and any name you want. If you use a different path or name, be sure to change in the rest of the commands below.
2097152 - This is the size of the file system you want to create. This number is the number of file system blocks, which the mkfs.vfat command defaults to 1024 bytes each, or 1 KB. So this number should be how many kilobytes the file should be. E.g. 1 MB is 1024 KB, and 1 GB is 1048576 KB. I chose 2097152 blocks for mine, which equates to 2 GB. You can adjust this value depending on how many mods you want to be able to install at one time.

Run this command as root on your system and verify it created a new file at the specified path. It is already formatted with the FAT32 file system, so next we need to use it.

Mounting the virtual file system

You can’t access the virtual file system directly through the file we created in the last step; it must be mounted to the local file system as a virtual block device so it can be used by the operating system. To do that, we’ll use a loopback device.

Choosing a loopback device

Loopback devices typically use the naming convention /dev/loopXX where XX is any numeric digit. To see if you have any loopback devices in use already, you can run the command losetup -l. If you don’t see loopback devices listed, then you are free to pick any number, or start at 0. If you do see any loopback devices, just choose a number that’s not in use. You can either use the next available number, or choose an arbitrary higher number to leave room for other programs creating loopback devices.

To create the loopback device, run the following command:

losetup /dev/loopXX /opt/steam-workshop.img

losetup - This is the name of the program that creates, manages, and deletes loopback devices on your system.
/dev/loopXX - This is the loopback device to create. Replace the XX with number you chose previously.
/opt/steam-workshop.img - This is the path to the virtual file system you created in the previous section.

If the command ran successfully, the virtual file system file is now running as a block device on your system. The next step is to mount it so your operating system can access the files in it.

Manually mounting the virtual file system

Next, you can mount the virtual file system by running the following command:

sudo mount -o uid=<user>,gid=users,fmask=113,dmask=002,iocharset=iso8859-1 /dev/loopXX "/path/to/steam/steamapps/workshop/content"

sudo mount - This command mounts file systems into your root file system for the operating system to use. It must always be run as the root user.
-o uid=<user>,gid=users,fmask=113,dmask=002,iocharset=iso8859-1 - This specifies the options for the file system to be mounted. Replace <user> with your username. The uid and gid options specify the user and group that the file system should be mounted with. The fmask and dmask options set the file permissions. And finally iocharset sets the character encoding for filenames.
/dev/loopXX - This is the loopback device you created previously. Replace XX with the number of the loopback device you created.
"/path/to/steam/steamapps/workshop/content" - This is the path to the workshop content (mods + other downloadable content from Steam) on your computer. It can vary from system to system and the way Steam was installed. But once you find the directory steam is installed at, inside you should find the steamapps/workshop/content folder where any current mods for any game are installed. Note the double quotes around the path. If there’s already content inside this folder, be sure to back it up before mounting this directory! It’s as simple as cp -r content/ content_old/.

After running this command, the virtual file system should be mounted in Steam’s content directory, meaning any files the Steam workshop downloads to your computer will be stored in the virtual file system instead of on your disk.

If you backed up existing files from the content directory, you can use this command to restore those files:

cp -a content_old/* content/

The -a flag will recursively copy all files, preserving file permissions, ownership, timestamps, and extended attributes. Just make sure the content/ directory is empty, as this command will overwrite any files with the same name.

Automatically mounting the file system

If you followed the instructions previously to manually mount the virtual file system, you will notice that it will become unmounted every time you turn off the computer. You can create a systemd service to automatically mount the file system at boot.

First, create the service file using your favorite text editor. I’m using nano because it’s objectively the best. The file can be named whatever you want, as long as it ends with .service and can be found in the /etc/systemd/system/ directory. If you use a different service name, be sure to change the name in the rest of the commands.

sudo nano /etc/systemd/system/steam-workshop.service

And add the following content to it:

[Unit]
Description=Steam Workshop virtual drive device and mount
After=local-fs.target
Before=graphical.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c '/sbin/losetup /dev/loopXX /opt/steam-workshop.img && /bin/mount -o uid=<usr>,gid=users,fmask=113,dmask=002,iocharset=iso8859-1 /dev/loopXX "/path/to/steam/steamapps/workshop/content"'
ExecStop=/bin/bash -c '/bin/umount "/path/to/steam/steamapps/workshop/content" && /sbin/losetup -d /dev/loopXX'
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Here are the important things to note about this service file:

Description= - The description for this systemd service. You can put anything here.
After=local-fs.target - This will prevent this service from starting until after the local file system has been initialized. This is important because we are loading from an existing file on the local file system, so we have to make sure the local file system is fully initialized before mounting the virtual file system.
Before=graphical.target - This specifies that the graphical subsystem should not start until this service completes. That means the virtual file system should be mounted before the graphics system is initialized. This is helpful if you have Steam set to start at system startup: it will prevent Steam from auto-starting before the virtual file system has been mounted, causing Steam to see an empty content/ directory.
Type=oneshot - This specifies that this command will run a single command and terminate (as opposed to a daemon that runs forever). This informs systemd how to manage and report the status of this service.
ExecStart= - This is what systemd will run when it starts your service. It should look similar to the steps to manually mount the virtual file system. Things to note about this command:
- It combines both the creation of the loopback device and mounting it into one command, joined by &&. The whole thing is wrapped in a call to /bin/bash -c '...' because systemd can only run one command. Note the single quotes; since the command uses double quotes around the file path, we use single quotes here to not interfere with those.
- We use the full path to /sbin/losetup instead of just the command name itself. Since this is running early on in the boot process, it’s safer to refer to the executable directly instead of relying on the PATH environment variable being set up correctly.
ExecStop= - This is the command that’s run when systemd attempts to stop this service; either automatically or when you run systemctl stop steam-workshop.service (or whatever you named the service). It’s the same steps in ExecStart but opposite and in reverse order: unmounting the virtual file system and destroying the loopback device. This allows systemd to cleanly shutdown and free those resources either during system shutdown or if you manually specify it on the command line. Without this step you may be stuck with leftover resources not cleaned up preventing you from remounting things.
RemainAfterExit=yes - This tells systemd that the service will exit after starting but to mark it as still active (as long as it ran the startup command successfully). This will cause systemd to report the status of this service correctly, as well as making sure the ExecStop command is run during shutdown. Without this command systemd would consider this service inactive after it finishes running ExecStart and wouldn’t run ExecStop later.
WantedBy=multi-user.target - This indicates to systemd when to run this script during boot up.

After creating the service, enable and start it with sudo systemctl enable --now steam-workshop.service. Now the virtual file system will be created and mounted automatically when the computer boots up, ready for Steam to use. Since it’s mounted in the directory Steam expects workspace content to be, any newly subscribed content will automatically be added to the virtual file system.

How To: Set up a reverse proxy

2026-03-16T00:00:00-07:00

Setting up external access to servers inside your home network is possible by setting up reverse tunnels behind a reverse proxy.

You will need an external server that is publicly accessible by the Internet. This server can serve any number of private servers inside your network via a reverse proxy. I personally use a basic DigitalOcean droplet that costs $6 per month. You don’t need a lot of power for this server, but you want something that won’t max out your bandwidth or CPU limits, as that will introduce a lot of latency to your SSH tunnels and ultimately your applications.

You will need to configure two components to enable access to your home network. First, set up the reverse tunnel to tunnel traffic from the remote server to the local server. Then, configure the reverse proxy on the remote server to direct traffic to the reverse tunnel.

Definitions

External/Remote server: This is the server that is running outside of your network and is publicly accessible from the Internet.
Local/Private server: This is a server running inside of your home network. You can have multiple local servers, in which you would follow these instructions for each tunnel on each server.
Reverse tunnel: This is an SSH tunnel that is established from the server that the traffic is being forwarded to. This is the opposite of a traditional tunnel which is initiated from the server sending the traffic, hence the name reverse tunnel. Reverse tunnels are useful when the destination of the traffic is inaccessible from the source of the traffic, such as a home network that has inbound traffic blocked by an ISP.
Reverse proxy: This is a web server that listens for HTTP/s traffic and redirects (i.e. proxies) that traffic to a different endpoint. In this setup, the reverse proxy helps isolate your network and tunnel from potentially dangerous traffic on the Internet. A traditional proxy is a web server that processes outbound traffic, hence why one that processes inbound traffic is called a reverse proxy.

Reverse SSH Tunnel

The reverse tunnel creates an SSH session to a remote machine and tunnels traffic from the remote machine to the local machine. You will need one reverse tunnel for each port you want to forward traffic to. You can have as many tunnels as you need from the same machine.

Setting up the reverse tunnel

Use the following ssh command from the local server to create the reverse ssh tunnel:

/usr/bin/ssh -N -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -R <remote-listening-port>:<local-forwarding-server>:<local-forwarding-port> -i <path-to-private-key> <remote-username>@<remote-server>

-N: This option tells SSH not to set up a full shell session for this connection. This will only establish the SSH connection for the tunnel.
-o ServerAliveInterval=60: This option sends a keep-alive signal through the tunnel every 60 seconds. You may need this option if the tunnel is closed due to inactivity.
-o ServerAliveCountMax=3: This option tells the connection to terminate when 3 keep-alive signals are not responded to. This will automatically close the tunnel if the remote machine has disconnected or crashed without closing the connection. Without this option, the tunnel may stay open but unconnected and will need to be manually restarted in order to reconnect to the remote server. In addition, when used in a systemd service (covered in a later section), this allows the tunnel to automatically restart itself.
-o ExitOnForwardFailure=yes: This option tells SSH to exit with a failure if it can’t establish the connection. This allows it to automatically retry when inside of a systemd service.
-R <remote-listening-port>:<local-forwarding-server>:<local-forwarding-port>: This is the option for establishing the reverse tunnel. The tunnel will be set up to listen on port <remote-listening-port> on the remote server, and all traffic that arrives at that port will be forwarded to <local-forwarding-server> on port <local-forwarding-port> in your home network.

Note that by default, the remote port is bound to localhost, so it is not accessible to the Internet. You can choose to bind it to a public address by specifying a remote server address to bind to (for example, -R 0.0.0.0:<remote-listening-port>:<local-forwarding-server>:<local-forwarding-port> would allow any traffic to access the tunnel) but this is generally highly discouraged because you’re opening a direct connection from the Internet into your home network. There are bots constantly scanning the Internet for open ports to exploit, and then once an application is compromised they will move laterally inside your home network to compromise the rest of your devices. It’s recommended to keep the tunnels bound to localhost and run them behind a reverse proxy, which will be covered in the next section.
-i <path-to-private-key>: This option specifies the path to the private key file to use to authenticate the connection. You can use a different form of authentication if you want, for example username and password, but it’s highly recommended not to have your username or password hard coded, and key pair authentication is easier to use for unattended services.
<remote-username>@<remote-server>: Finally, this is the username and server (either IP address or domain name) of the remote server. The user should be a special user used just for your SSH tunnels and have all other permissions and logon rights disabled for security. Instruction on how to set this user up will be covered in a later section. However, you can also use just a regular logon user for this, it’s just less secure.

This is an example that I am currently using to create a tunnel from port 3001 on a public DigitalOcean droplet to an instance of Jellyfin running on the same machine on port 8096:

/usr/bin/ssh -N -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -R 3001:localhost:8096 -i /home/sshtunnel/.ssh/tunnel_rsa sshtunnel@cloud.michaelhumphrey.dev

Creating a service for the tunnel

If you run the reverse tunnel from the command line, it will only stay running as long as the command is running. If you close the terminal it’s running in, the reverse tunnel will terminate. You can always start the command and run it in the background, but then you may not notice if the tunnel shuts down, and is difficult to restart. To fix these issues, you can configure a systemd service to manage the tunnel for you. Below is a template you can use to create the service:

[Unit]
Description=<service-name>
After=network-online.target

[Service]
User=<username>
ExecStart=/usr/bin/ssh -N -o ServerAliveInterval=60 -o ServerAliveCountMax=3 -o ExitOnForwardFailure=yes -R <remote-listening-port>:<local-forwarding-server>:<local-forwarding-port> -i <path-to-private-key> <remote-username>@<remote-server>

RestartSec=5
Restart=always

[Install]
WantedBy=multi-user.target

Description=<service-name>: A short description of this tunnel.
After=network-online.target: Wait to start this service until after the network is online.
User=<username>: The user this service should run under. Ideally this would be a user that is only used to run the SSH tunnels and have no other permissions and logon rights disabled, but it can also be a regular user. See the next section for instructions on how to set up a user for the tunnel.
ExecStart=<ssh-command>: This is the command to be run when this service is started. See the previous section for instruction on how to set up the ssh command.
RestartSec=5: This option specifies that if this service stops for any reason, it should wait 5 seconds before restarting. You can set this to whatever you like, but it should be short enough to minimize downtime if the tunnel can be reestablished and long enough to let the network connection shutdown and cleanup its resources before trying again. For less critical application, you can set this upward of 30-60 seconds or more to avoid straining your server if the remote server becomes unavailable for a period of time. Don’t set this to anything less than two seconds, otherwise the service may be terminated for starting up too many times too quickly.
Restart=always: This option specifies that the service should always start up after it stops for any reason. You can also set this option to on-failure to only start back up if it crashed.

Creating a user for the tunnel

To minimize the attack vector of exposing a tunnel to your home network from the Internet, it is recommended to set up a dedicated user with minimal permissions to run the tunnel. This ensures that even if that account is compromised, attackers still don’t have access to any other systems. You only need one user for all of your tunnels to use. In these examples, I’m using sshtunnel as the username, but you can use any username you prefer.

On the remote server

First, create the user and required directories on the remote server:

sudo useradd -m -s /usr/sbin/nologin sshtunnel
sudo mkdir -p /home/sshtunnel/.ssh

useradd: This command creates the user that the tunnel will run under.
-m: This option creates a home directory for the new user. We will use this directory to store the scripts for running the tunnel and symlinking them to the appropriate system directories.
-s /usr/sbin/nologin: This option sets the user’s login shell to /usr/sbin/nologin. This is a special shell that disallows this user from logging into the system, but lets it run system services and create tunnels. This prevents this user from being commandeered by an attacker while still allowing us to authenticate with a minimum-permission account for setting up the tunnel.
mkdir This command create the directory where the user’s ssh credentials will live.
-p: This option creates all parent directories for this directory if they don’t already exist.

Next, ensure that the directories belong to the user we created, not the currently logged in user or root:

sudo chown -R sshtunnel:sshtunnel ~/sshtunnel/.ssh
sudo chmod 700 ~/sshtunnel/.ssh
sudo chmod 600 ~/sshtunnel/.ssh/authorized_keys

chown -R sshtunnel:sshtunnel ~/sshtunnel/.ssh: This command recursively sets all files and directories in ~/sshtunnel/.ssh to belong to the sshtunnel user and group.
chmod ...: These commands set the permissions of the directory to the minimum necessary. The ssh keys for login are stored in these directories, so it’s important to keep them secure.

On the local server

Next, set up the reverse tunnels on the local server to use the newly created user.

First, create ssh key pair for authentication:

sudo mkdir -p /etc/sshtunnel
sudo ssh-keygen -qN "" -f /etc/sshtunnel/id_rsa

mkdir -p /etc/sshtunnel: This command creates a new directory for the tunnel credentials to live.
ssh-keygen: This command creates a new key pair for authentication.
-q: This option silences the output of the ssh-keygen command. It is optional.
-N "": This option sets the passphrase of the key pair to an empty string, essentially disabling the password requirement to use it. This makes it easier to allow the automated services to use it without prompting for a password. However, it makes it all the more important to keep these keys private, as anyone can use them to gain access to your system.
-f /etc/sshtunnel/id_rsa: This option specifies the newly created directory to store the key pair in.

Next, modify the systemd service files for the tunnels to use the new user. Most importantly, that means setting these ssh options:

-i /etc/sshtunnel/ssh: This points ssh to the private key we just created for the sshtunnel user.
sshtunnel@<remote-server>: Set the username when connecting to the remote server to sshtunnel.

Finally, copy the public key /etc/sshtunnel/id_rsa.pub to the remote machine and add it to the authorized keys file in ~/sshtunnel/.ssh/authorized_keys. This will allow the remote server to recognize and authenticate the newly created user. Make sure you connect to the remote server with the new credentials manually from the command line so you can whitelist the remote server’s public key as well.

Reverse Proxy

The other component needed is a reverse proxy to direct traffic from the Internet into the private SSH reverse tunnel you set up. The reverse proxy can do a lot of useful things for you, including providing a HTTPS endpoint in front of your services, load balancing, authentication, etc.

Configuring the reverse proxy

I use NGINX for my reverse proxy, but you can really do this part with any web server. The configuration options will be different, but the theory is the same.

Here is how I have my reverse proxy set up to terminate HTTPS connections and forward through the reverse SSH tunnel:

server {
    server_name <external-domain-name>;
    client_max_body_size 500M;  # Only needed if you're expecting large payloads

    location / {
        proxy_pass http://127.0.0.1:<reverse-tunnel-remote-port>;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate <path-to-fullchain.pem>; # managed by Certbot
    ssl_certificate_key <path-to-privkey.pem>; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = <external-domain-name>) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name <external-domain-name>;
    listen 80;
    return 404; # managed by Certbot
}

The second server block just redirects all HTTP requests for this domain to HTTPS. This makes it easier for any clients attempting to connect with HTTP first to be forced to use HTTPS. This block is automatically added when using the LetsEncrypt client.

The first server block handles all of the actual proxying.

server_name <external-domain-name>: This binds this server block to a particular domain. Different server blocks can be bound to different domains and ran simultaneously; NGINX will just check which domain a request is for and use the configs for the associated server block. If you don’t have this label, it will use it for all incoming requests, but then you would only be able to have one server block configuration for everything.
client_max_body_size 500M: By default NGINX limits incoming request payloads to 1 megabyte. This is fine for most applications, but if you need to set it to be larger (for example, Nextcloud or other backup solutions) you can use this option to set that limit higher. Note that sending excessively large payloads to overwhelm your server is a common denial-of-service attack and can result in exorbitant server expenses, so only use this option if you need it and set it to the lowest value that you actually expect to use.
location /: This block specifies the URL root. Setting the root to / will make this block handle all requests on the domain. You can specify a URL fragment if you want to run multiple services on the same domain. For example, you can have one service in a location /foo block and another service in a location /bar block, and then have different settings in each one. Then requests coming in at mydomain.com/foo will be sent to a different SSH tunnel than requests coming in to mydomain.com/bar.

While this configuration will allow NGINX to route subpath requests to different SSH tunnels, the applications running behind those tunnels will have to be configued to support such a configuration, as clients will still end the entire URL with the subpath in their HTTP requests. Not all applications support running on a subpath, so it’s up to you to decide which ones, if any, will run that way. I personally prefer to use subdomains to separate my services (e.g. foo.mydomain.com and bar.mydomain.com) as it’s easier and cleaner to support, but you do need full control over your domain to do so.
proxy_pass http://127.0.0.1:<reverse-tunnel-remote-port>: This option specifies where traffic in this block should be forwarded to. The 127.0.0.1 specifies it should be forwarded to the localhost, where the reverse tunnel is listening. <reverse-tunnel-remote-port> should be the same remote port you specified when setting up the reverse tunnel. We are connecting the reverse proxy to the tunnel here.
proxy_set_header ...: These configs are to properly pass request headers through the proxy to the application behind the proxy. Many services require these headers to be set properly, especially if you’re running security applications. Applications may not work, generate security errors, or report incorrect data if these are headers are not set correctly.
The remaining headers in the server block are to configure HTTPS. These should be automatically added when requesting a certificate through LetsEncrypt.

NGINX configuration files

The configuration for a reverse proxy should be saved with the filename that matches the domain it’s running on. For example, if your reverse proxy is running for the domain foobar.mydomain.com, then you would save the configuration in a file called foobar.mydomain.com. The directory for these configurations is by default /etc/nginx/sites-available. Then, when you’re finished editing the configuration file, create a symlink to the file in /etc/nginx/sites-enabled using the command :

ln -s <target-path> <link-name>

The target path is the full path to the file you want to symlink to (for example, /etc/nginx/sites-available/foobar.mydomain.com) and the link-name is the name you want the link to have (in most cases, it should be the same). When you are done, you can check the link by typing ls -l and you should see something like this:

lrwxrwxrwx 1 root root 45 Apr  6  2024 foobar.mydomain.com -> /etc/nginx/sites-available/foobar.mydomain.com

Once the symlink is created, your reverse proxy configuration is now ready to be used. First run the command nginx -t to test your configuration files. If there are any errors, fix them now. When the test returns successfully, you can reload the NGINX configs with the command systemctl reload nginx. Your reverse proxy is now live and directing HTTP traffic to your tunnel.

Alternatives to self-hosting

If you don’t have a publicly accessible server or don’t want to purchase a VPS (virtual public server) to host the external reverse proxy, there are other services that will do the equivalent of these steps for you. I have used Packet Riot in the past to forward traffic from the internet to my local network. Their free tier offers up to one tunnel, unlimited HTTP/s proxies for that tunnel, 1 TCP proxy for the tunnel, and up to 1 gigabyte of bandwidth per month. The next tier is only $5 / month and allows up to a terabyte of bandwidth. I like this service quite a bit, but ultimately had some intermittent issues that led me to pursue hosting my own reverse proxy since I already paid for a VPS.

Many self-hosters use ngrok as a reverse proxy for their services. It’s quite a bit more expensive but can handle almost everything for you. Tailwind is also a great option if you don’t need your services to be truly public, but want to access your services from your own devices from anywhere in the world. There’s countless other alternatives out there that will all do the same thing, but ultimately under the hood they function the same way as the tools described in this document.