Oh, that's kind of interesting. I've always used Tor hidden services for this.
I didn't try Tor since it seems too slow/unreliable for interactive work via ssh. Also I don't need the service to be hidden. My main concern was security on the client/MacBook side, which is why I went with a very limited podman pod that run stock debian 13 with solid easy to manage firewall filtering using nftables.
