move the "self-service SSH tunnel" label to avoid ambiguity