I actually have a similar setup, but I dynamically add a route to traefic with the API through the same ssh tunnel.

I also set it up with a wildcard certificate so the https is instantly available.