This isn't actually working properly, but it's kind of close. For some reason I can't get the ssh portfw to run automatically. It'd probably be smarter to do the portfw through iptables anyway, but I'm allergic to iptables.

setting up an openwrt router as an iTunes proxy:

1. install avahi:

   ipkg install http://nthill.free.fr/openwrt/ipkg/testing/libexpat_1.95.8-1_mipsel.ipk
   ipkg install http://nthill.free.fr/openwrt/ipkg/testing/libdaemon_0.8-1_mipsel.ipk
   ipkg install http://nthill.free.fr/openwrt/ipkg/testing/libavahi_0.5-1_mipsel.ipk
   ipkg install http://nthill.free.fr/openwrt/ipkg/testing/libgcc_3.4.4-2_mipsel.ipk
   ipkg install http://nthill.free.fr/openwrt/ipkg/testing/avahi-daemon_0.5-1_mipsel.ipk

2. create /etc/avahi/services/itunes.service:

   <?xml version="1.0" standalone='no'?><!--*-nxml-*-->
   <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
   <service-group>
    <name replace-wildcards="yes">iTunes Server on %h</name>
     <service>
      <type>_daap._tcp</type>
      <port>3689</port>
     </service>
   </service-group>

3. put this at the end of /etc/init.d/S99done:

   [ ! -d /tmp/.ssh ] && {
           mkdir /tmp/.ssh
   }
   [ -f /tmp/.ssh/known_hosts ] && {
           rm /tmp/.ssh/known_hosts
   }
   ln -s /etc/known_hosts /tmp/.ssh/known_hosts

4. make cert:

   cd /etc/dropbear
   dropbearkey -t rsa newkey

5. put the key into authorized_keys2 on the iTunes server
6. launch the port forward with:

   /usr/bin/ssh -T -i /etc/dropbear/newkey -g user@your.itunes.server -L 3689:127.0.0.1:3689 &

7. figure out how to get it to run automatically