I've a device that's running an HTTP server. It doesn't have a fully qualified domain name, and installing a self-signed certificate on every client is tedious. In other words, no HTTPS.
I've blocked ingress traffic to the server's HTTP ports, and am currently connecting to it via an SSH tunnel.
When using an SSH tunnel, from my client device to device A, to access and use plain-text HTTP forms on a web server running on that device A, are my communications secure?