...in case folks don't have that in their ssh config already

howto/cumin.md

@@ -82,7 +82,7 @@ Description=Setup port forward to puppetdb
 After=network.target
 
 [Service]
-ExecStart=/usr/bin/ssh -nNT -o ExitOnForwardFailure=yes puppetdb-01.torproject.org
+ExecStart=/usr/bin/ssh -nNT -o ExitOnForwardFailure=yes -L 8080:localhost:8080 puppetdb-01.torproject.org
 KillMode=mixed
 
 ```
@@ -91,6 +91,10 @@ With this in place, make sure that systemd has loaded this unit file:
 
     systemd --user daemon-reload
 
+Note: if you already have a line `LocalForward 8080 127.0.0.1:8080` under a
+block for host puppetdb-01.torproject.org in your ssh configuration, you can
+safely drop the `-L` argument in the ssh command in the systemd unit above.
+
 The last missing piece is to create something that'll intercept `cumin` commands
 and check whether your tunnel to puppetdb is currently listening and if not,
 start the tunnel before handing your arguments to the actual `cumin` command.