I have such a setup running without a tunnel so I cannot comment on the ssh tunnel stuff but please note that
1. You dont have to touch the avahi config. The mt-daapd beta will automatically connect to the avahi-daemon (vid dbus or so) and tell it to announce. So the avahi config on your server side is not the problem. I did not need to change anything on avahi to get my system to run.
2. You need to run RendezvousProxy on the LOCAL side where you want to play the music. And this RendezvousProxy needs to announce either
a) If you use ssh tunnel: The LOCAL IP:port that ssh will automatically tunnel to the remote site. Not the IP:port of the remote mt-daapd side!
b) If you use no tunnel and have a firewall forward on your home router (as Ron disrecommended): Only then you need to have the RendezvousProxy point to the remote (outside – WAN) IP:port.
I am running this setup with a password set on the mt-daapd since a while without problems. If you are afraid about the exposure of the port and the possible security problems then you need to do a). But as a test to exclude any problems from the ssh tunnel stuff it could be useful anyway.
See:
http://forums.rokulabs.com/viewtopic.php?t=10526
and
http://forums.fireflymediaserver.org/viewtopic.php?t=5374
for details.
Which also contains some discussions about the security. I have in the meantime patched my personal mt-daapd version to report failed logins. So far no problems.