# ghostunnel/ghostunnel

A simple TLS proxy with mutual authentication for securing non-TLS services.

Repository: https://github.com/ghostunnel/ghostunnel
Canonical: https://ross.abutalabs.com/products/ghostunnel
Homepage: https://ghostunnel.dev/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: tls, tunnel, ssl, proxy, stunnel, go, security, crypto, pkcs11, hsm, keychain
Last push: 2026-08-22T21:06:09+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 99, longevity 100
- inputs: {"age_days": 3983, "days_push": 11, "days_rel": 11, "gap_med": 25.5, "n_releases_24m": 11}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2192, forks 288 (observed 2026-08-28T04:06:24.214818+00:00)

## What it is
Ghostunnel is a simple TLS proxy written in Go that adds mutual TLS authentication in front of (or behind) non-TLS backend services, in client or server mode over TCP or UNIX sockets. It supports flexible certificate sources (PEM, PKCS#12, ACME, PKCS#11 HSMs, OS keychains, SPIFFE), certificate hotswapping, OPA-based access control, and Landlock sandboxing.

## Use cases
- add TLS to a non-TLS backend service
- terminate mutual TLS in front of an internal service
- add client certificates to a legacy client
- replace stunnel with a modern Go TLS proxy
- enforce per-client access control based on certificate fields
- use short-lived certificates with hot reload
- load private keys from an HSM or macOS Keychain

## When to choose
- you need mTLS termination for services that don't speak TLS
- you want a single static binary with no runtime dependencies
- you need certificate rotation without restarts or flexible key sources (ACME, HSM, SPIFFE)
- you want fine-grained client authorization via cert fields or OPA policies

## When to avoid
- you need an HTTP reverse proxy with routing, load balancing, or header manipulation (use a full proxy like Envoy or nginx)
- you need a VPN or encrypted overlay network rather than per-connection TLS tunneling
- you need application-layer protocol awareness beyond PROXY protocol and ALPN

## Facets
- artifact type: cli-tool
- maturity: active
- function: proxy, security, cryptography, networking, auth, authorization
- domain: security, networking, self-hosted
- platform: windows, bsd, cross-platform, cli
- tags: tls-proxy, mutual-tls, stunnel-alternative, mtls, certificate-rotation, spiffe, pkcs11, landlock, opa, devops, linux, macos, docker

## Member repositories
- ghostunnel/ghostunnel (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:24.214818+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:47:26.354822+00:00, confidence not recorded.
  - readme: https://github.com/ghostunnel/ghostunnel (fetched 2026-08-28T04:06:24.214818+00:00, sha 1b4413a7ce5f)
  - homepage: https://ghostunnel.dev/ (fetched 2026-08-29T10:27:55.987367+00:00, sha 579d070ab413)
  - site_page: https://ghostunnel.dev/docs (fetched 2026-08-29T10:27:55.996862+00:00, sha 75c515282386)
  - site_page: https://ghostunnel.dev/docs/getting-started/quickstart (fetched 2026-08-29T10:27:56.001892+00:00, sha efc84f00ab3c)
  - site_page: https://ghostunnel.dev/docs/security (fetched 2026-08-29T10:27:56.003876+00:00, sha 856627dc6ace)
  - site_page: https://ghostunnel.dev/docs/security/access-flags (fetched 2026-08-29T10:27:56.005935+00:00, sha 96df635d904f)
  - site_page: https://ghostunnel.dev/docs/certificates/reloading (fetched 2026-08-29T10:27:56.008963+00:00, sha a97d1cd3e6c4)
  - site_page: https://ghostunnel.dev/docs/certificates (fetched 2026-08-29T10:27:56.011110+00:00, sha 9666f79dd77f)
  - site_page: https://ghostunnel.dev/docs/security/general (fetched 2026-08-29T10:27:56.013198+00:00, sha d2cb27511974)
  - site_page: https://ghostunnel.dev/releases (fetched 2026-08-29T10:27:55.998997+00:00, sha 12420ed4c4fb)
- Data as of 2026-08-30T08:39:29.467469+00:00.