example of client-managed tunneling
doc
services_file can be remote, as host:path
doc