You can use a localhost Cockpit with SSH Port Forwarding.
> Configure Cockpit to listen only loopback/127.0.0.1[1]:
[Socket]
ListenStream= #This remove 0.0.0.0:9090 bind based on the docs
ListenStream=127.0.0.1:9090
> Execute in your machine a port forward with SSH[2]:
ssh -N -L 9090:127.0.0.1:9090 host@ip
> Then you can open localhost:9090 in your browser securely only using SSH (that is already part of your actual workflow).
[1]: https://cockpit-project.org/guide/latest/listen
[2]: https://coder.com/docs/code-server/guide#port-forwarding-via...
Yes but if there's going to be something lightweight and correct-by-default I'd prefer that, mostly because I have many machines to manage and a team of people to educate. I'd like default to be good instead of wasting time and risking.