Documentation
Getting Started
Quick start guide and flag overview.
Certificates & Identity
How Ghostunnel obtains, loads, and rotates certificates.
Certificate Formats
Supported certificate and key formats, how to prepare them, and how Ghostunnel selects the right loader.
ACME Support
Automatically obtain and renew public TLS certificates via Let's Encrypt or other ACME certificate authorities.
SPIFFE Workload API
Automatically manage certificates and trusted roots via SPIRE or other SPIFFE-compatible workload identity providers.
HSM/PKCS#11 Support
Load private keys from hardware security modules via the PKCS#11 interface.
Keychain Support
Load certificates and private keys from the macOS Keychain or Windows Certificate Store, including hardware-backed keys.
Certificate Reloading
Reload certificates, CA bundles, and OPA policies without restarting, enabling the use of short-lived certificates.
Security & Access Control
Protocol configuration and authorization rules to decide who is allowed to connect.
General Security
Landlock sandboxing, TLS protocol settings, cipher suites, address restrictions.
Access Control Flags
Control which clients or servers are allowed to connect based on certificate fields (CN, OU, DNS/URI SAN) or OPA policies.
Software Bill of Materials
Where to find SPDX and CycloneDX SBOMs for release binaries and Docker images, and how to inspect them.
Networking & Integration
PROXY protocol, graceful draining, and metrics.
PROXY Protocol
Pass original client connection metadata (IP, TLS version, client certificate) through to plaintext backends using HAProxy's PROXY protocol v2.
Graceful Shutdown
How Ghostunnel handles shutdown signals, drains in-flight connections, and force-exits after a timeout.
Metrics & Profiling
Expose status, health checks, and metrics in JSON or Prometheus format via the built-in status port.
Deployment & Operations
Running Ghostunnel as a container or as a supervised system service.
Docker Images
Available Docker image variants and tags for running Ghostunnel in containers.
Systemd (Linux)
Run Ghostunnel as a systemd service with socket activation, readiness notification, and watchdog support.
Launchd (macOS)
Run Ghostunnel as a macOS launchd daemon with socket activation.
Windows Service
Install and manage Ghostunnel as a native Windows service via the Service Control Manager.
Reference
Platform-specific man pages with every flag and mode documented.