hiera.glob: + :tunnel to access local port :8140 (puppet)

The purpose is to forward puppet master to all nodes

  tiny:8140 (real puppet master) <-- localhost:8140 [remote]

From tiny, run "ssh -R 8140:localhost:8140 remote" to create a tunnel.

There are some questions (not easy to answer though)

* Should the :ssh command be invoked from the :puppet account?
* What to do if we need to open another local port?
* What to do if we need to some special support for some node?
* Is there any security issue with new :tunnel accounts?
* What is the best shell for the :tunnel accounts?