ghostunnel/ghostunnel

Health v2 · maintenance only

Adoption not part of the score

2192 stars · 288 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Ghostunnel is a simple TLS proxy written in Go that adds mutual TLS authentication in front of (or behind) non-TLS backend services, in client or server mode over TCP or UNIX sockets. It supports flexible certificate sources (PEM, PKCS#12, ACME, PKCS#11 HSMs, OS keychains, SPIFFE), certificate hotswapping, OPA-based access control, and Landlock sandboxing.

Use cases

• add TLS to a non-TLS backend service
• terminate mutual TLS in front of an internal service
• add client certificates to a legacy client
• replace stunnel with a modern Go TLS proxy
• enforce per-client access control based on certificate fields
• use short-lived certificates with hot reload
• load private keys from an HSM or macOS Keychain

When to choose

• you need mTLS termination for services that don't speak TLS
• you want a single static binary with no runtime dependencies
• you need certificate rotation without restarts or flexible key sources (ACME, HSM, SPIFFE)
• you want fine-grained client authorization via cert fields or OPA policies

When to avoid

• you need an HTTP reverse proxy with routing, load balancing, or header manipulation (use a full proxy like Envoy or nginx)
• you need a VPN or encrypted overlay network rather than per-connection TLS tunneling
• you need application-layer protocol awareness beyond PROXY protocol and ALPN

Facets

cli-tool · maturity active

proxy security cryptography networking auth authorization security networking self-hosted windows bsd cross-platform cli tls-proxy mutual-tls stunnel-alternative mtls certificate-rotation spiffe pkcs11 landlock opa devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ghostunnel/ghostunnel")