# Install ghostunnel with Homebrew, Nix Simple SSL/TLS proxy with mutual authentication. Version 1.11.2 via Homebrew; verified 2026-07-29. Also installable with nix: nix profile install nixpkgs#ghostunnel. ## Install ```sh sudo av install brew:ghostunnel ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install ghostunnel ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#ghostunnel ``` Evidence: nixpkgs package indexes: pkgs/by-name/gh/ghostunnel/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:ghostunnel - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.11.2 - **Source summary:** Simple SSL/TLS proxy with mutual authentication - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-07-29T16:05:00+02:00 - **Generated:** 2026-08-04T22:13:35+00:00 ## Executables - ghostunnel (cli) - ghostunnel (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-08-04 - Package-manager version: 1.11.2 - Package-manager updated: 2026-07-29 - Local data: ok - Upstream repository: https://github.com/ghostunnel/ghostunnel - Upstream latest detected: v1.11.2 (current) ## Project history and usage Ghostunnel is a Go TLS proxy for placing mutual TLS in front of services that do not speak TLS themselves. ### Project history The Ghostunnel repository was created in 2015 and its first GitHub release, v1.0.0, was published in 2016. Its README frames the project as a simple TLS proxy with mutual authentication for securing non-TLS backend applications. The project evolved around two complementary modes: server mode terminates TLS and forwards to an insecure backend, while client mode accepts local insecure connections and forwards them to a TLS-secured service. Over time the README grew to document certificate reloads, ACME, PKCS#11, macOS Keychain, Windows Certificate Store, SPIFFE Workload API, Prometheus metrics, systemd and launchd socket activation, and Windows service management. ### Adoption history Ghostunnel's adoption sits in security and operations teams that need a small proxy rather than a full service mesh or general reverse proxy. Official materials point users to GitHub releases and Docker Hub, and the project documents Linux, macOS, Windows, and other Go-supported Unix systems. ### How it is used Practitioners use Ghostunnel to wrap legacy TCP services with mutual TLS, add client-certificate authorization, run local TLS clients for remote services, reload short-lived certificates, expose metrics, and deploy the proxy under a service manager. ### Why package nerds care Package nerds care about Ghostunnel because it packages a focused security boundary as one executable: install it, provide certificates, and put mTLS in front of a service without rewriting the application. ### Timeline - 2015: GitHub repository created. - 2016: v1.0.0 initial release published. - 2020s: Documentation covers OPA policies, SPIFFE identities, hardware-backed keys, certificate reloads, metrics, and service-manager deployment. ### Related projects - Ghostunnel is adjacent to stunnel, OpenSSL tooling, mkcert, cfssl, SPIFFE, Open Policy Agent, systemd, launchd, and Docker-based deployment workflows. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** ghostunnel - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - ghostunnel: normalized package name match | nixpkgs package indexes: pkgs/by-name/gh/ghostunnel/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Related links - [Terminal utility packages](https://pkg.so/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://pkg.so/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Homebrew utility packages](https://pkg.so/brew-utility-packages/) - Matched Homebrew package provider. - [go](https://pkg.so/brew/go/) - Build dependency declared by Homebrew. - [pure-ftpd](https://pkg.so/brew/pure-ftpd/) - Shares pkgdb curated category or tags: cli, networking, security, tls. - [sing-box](https://pkg.so/brew/sing-box/) - Shares pkgdb curated category or tags: cli, networking, proxy. - [xray](https://pkg.so/brew/xray/) - Shares pkgdb curated category or tags: cli, networking, proxy. - [proxychains-ng](https://pkg.so/brew/proxychains-ng/) - Shares pkgdb curated category or tags: cli, networking, proxy. - [v2ray](https://pkg.so/brew/v2ray/) - Shares pkgdb curated category or tags: cli, networking, proxy. - [hubble](https://pkg.so/brew/hubble/) - Shares pkgdb curated category or tags: cli, networking, security. - [squid](https://pkg.so/brew/squid/) - Shares pkgdb curated category or tags: cli, networking, proxy. - [mihomo](https://pkg.so/brew/mihomo/) - Shares pkgdb curated category or tags: cli, networking, proxy. - [go-camo](https://pkg.so/brew/go-camo/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, networking, proxy, security, tls. - [gost](https://pkg.so/brew/gost/) - Local package facts share a topical domain. Shared terms: cli, networking, proxy, simple. - [overtls](https://pkg.so/brew/overtls/) - Local package facts share a topical domain. Shared terms: cli, networking, proxy, simple. ## Combined YAML source View the package source record on GitHub. [combined/ghostunnel.yml](https://github.com/mxcl/pkgdb/blob/main/combined/ghostunnel.yml) ## Sources - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph