Greptile Summary

This docs-only PR fills a real gap in the Hetzner guide: users with hardened SSH configs hit a cryptic channel 3: open failed: administratively prohibited error when running the SSH tunnel because AllowTcpForwarding is disabled. The added prerequisite block is technically accurate — AllowTcpForwarding local is the minimal correct setting for ssh -L, the quoted error string matches the real sshd rejection, and systemctl restart sshd is the right follow-up.

• The technical content (AllowTcpForwarding local, error message, restart command) is all correct.
• One minor readability issue: the existing opener "After the shared build and launch steps, tunnel from your laptop:" now leads into a prerequisite block rather than directly to the tunnel command, making the phrase appear twice in close succession. A one-word change to that opener (see inline comment) would clean this up.

Confidence Score: 5/5

• Safe to merge — docs-only change with accurate technical content and no code impact.
• All technical details are correct, the change directly addresses a known user pain-point, and the only issue is a minor phrasing redundancy that does not affect correctness or user safety.
• No files require special attention.

This is a comment left during a code review.
Path: docs/install/hetzner.md
Line: 211

Comment:
**Introductory sentence now misleads**

Line 211 still reads "…tunnel from your laptop:" as if the tunnel command immediately follows, but the new prerequisite block is inserted in between. The phrase appears again at line 225 ("…and run the tunnel from your laptop:"), so the opener reads as redundant and misleading.

```suggestion
    After the shared build and launch steps, complete the following setup to open the tunnel:
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "docs: add AllowTcpForwarding prerequisit..." | Re-trigger Greptile}

ProjectClownfish pushed a narrow repair to this branch so the original contributor path can stay canonical.

Source PR: #54564
Validation: pnpm check:changed
Contributor credit is preserved in the branch history and PR context.

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve.

Keep this PR open. Current main still documents the Hetzner SSH tunnel without the requested AllowTcpForwarding local prerequisite or the administratively prohibited failure symptom, and the latest release tag lacks it too. The PR is a narrow docs/changelog patch tied to the already-closed report #54557, with no security-sensitive file changes in the provided diff.

Best possible solution:

Keep this PR open for maintainer review and merge, or land an equivalent docs/changelog change that adds AllowTcpForwarding local before the Hetzner SSH tunnel command, mentions the administratively prohibited failure symptom, and preserves credit for the related reports #54557 and #54954.

What I checked:

• Current main lacks the requested Hetzner guidance: At current checkout a820a307dfeb950fa633c0ae6fb2386a35a91991, the Hetzner-specific access step goes directly from “tunnel from your laptop” to the ssh -N -L 18789:127.0.0.1:18789 root@YOUR_VPS_IP command, with no AllowTcpForwarding, sshd_config, restart, or administratively prohibited text. Public docs: docs/install/hetzner.md. (docs/install/hetzner.md:220, a820a307dfeb)
• Targeted repository search found no landed equivalent: Searches for AllowTcpForwarding, administratively prohibited, sshd_config, TCP-forwarding phrasing, and the Hetzner tunnel command found SSH tunnel references but no landed docs/changelog text for the requested prerequisite or failure symptom. (a820a307dfeb)
• Latest release lacks the docs fix: The latest release tag v2026.4.26 contains the same Hetzner access step without the TCP-forwarding prerequisite or failure symptom, so this is not already shipped. Public docs: docs/install/hetzner.md. (docs/install/hetzner.md:220, be8c24633aaa)
• OpenSSH behavior supports the proposed setting: The local sshd_config manpage says AllowTcpForwarding accepts yes/all/no/local/remote, and that local allows local forwarding only while remote allows remote forwarding only, matching the PR’s ssh -L tunnel use case.
• PR scope and security review: The provided PR metadata shows only CHANGELOG.md and docs/install/hetzner.md changed, adding the AllowTcpForwarding local prerequisite, the failure string, and restart guidance. It does not touch workflows, scripts, lockfiles, dependency sources, publishing metadata, secrets handling, generated/vendor code, or executable install/build paths. (docs/install/hetzner.md:218, cbb259691e5c)
• History and routing evidence: Current-main blame and git log -S for the Hetzner access heading and tunnel command point to 7b2b0d07e84e3e124bdd55747f30ca4946e15edd, authored by Peter Steinberger. The PR timeline also records Vincent’s narrow branch repair at cbb259691e5c7939d17b3ce791f5dfd872d6759a. Public docs: docs/install/hetzner.md. (docs/install/hetzner.md:220, 7b2b0d07e84e)

Likely related people:

• steipete: Current-main blame and git log -S for the Hetzner access block point to Peter Steinberger’s recent docs import/update commit, and the latest release tag inspected for this surface is also under his release history. (role: current docs path maintainer; confidence: high; commits: 7b2b0d07e84e, be8c24633aaa; files: docs/install/hetzner.md, CHANGELOG.md)
• vincentkoc: The PR timeline says Vincent pushed the narrow branch repair to preserve the contributor path, and the provided PR metadata identifies cbb259691e5c7939d17b3ce791f5dfd872d6759a as the current PR head touching the Hetzner docs and changelog. (role: recent maintainer follow-up; confidence: medium; commits: cbb259691e5c; files: docs/install/hetzner.md, CHANGELOG.md)

Remaining risk / open question:

• Closing this PR now would drop an active docs/changelog patch for a gap that still exists in current main and in v2026.4.26.
• The content is SSH hardening guidance, so maintainers should still review the final wording and distro-appropriate restart command before merge; no supply-chain or executable-path risk was found in the provided diff.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a820a307dfeb.