A wrapper script that will start a local SSH tunnel (only in development environment), and then start Puma as normal. I use this with foreman from a Procfile.

bin-puma

#!/usr/bin/env sh
CURRENT_ENV=${RACK_ENV:-development}

# For the payment gateway callback URL
if [ "$CURRENT_ENV" == "development" ]; then
  PORT_SSL=$(expr $PORT + 1)

  echo "starting an SSL tunnel from :$PORT_SSL --(--)--> :$PORT"
  bundle exec tunnels $PORT_SSL 0.0.0.0:$PORT &
fi

bundle exec puma -b tcp://0.0.0.0:$PORT -t 0:${WEB_CONCURRENCY:-16} -e $CURRENT_ENV

# USAGE:
# from a Procfile (bundler) you'd use this as
# web: bin/puma