Ghostunnel Files

Highlights

• Native Windows Service Control Manager support. Ghostunnel can now run as a proper Windows service, with service install/uninstall/start/ stop/status subcommands and Windows Event Log integration via the new --eventlog flag (#712, [#713], [#717], thanks to @bdudley-cw for [#712] and [#717]).
• TLS settings modernization. Dropped the explicit CurvePreferences setting so Ghostunnel inherits Go's defaults (which include the X25519MLKEM768 hybrid post-quantum key exchange), and added read/idle timeouts plus a bounded shutdown context on the status HTTP server (#761).
• FreeBSD in CI. Integration tests now run on FreeBSD in GitHub Actions, with coverage uploaded to Codecov (#750).

New Features

• Windows Service Control Manager. New service install, service uninstall, service start, service stop, and service status subcommands register Ghostunnel with the Windows SCM. The service starts automatically on boot, responds to stop/shutdown controls from the SCM, and reports start/failure status back through the SCM (#712, [#717], thanks to @bdudley-cw). Non-Windows platforms are unaffected.
• Windows Event Log. New --eventlog flag sends logs to the Windows Event Log instead of stdout (#713).
• Generalized notify-ready. The systemd notify-ready code was generalized into a platform-independent helper and is now also used by the Windows SCM integration to signal readiness to the service manager.

Bug Fixes

• PROXY protocol over UNIX socket listeners. Fixed an issue where PROXY protocol on a UNIX socket listener dropped every connection (#751).
• Accept loop backoff. The accept loop no longer spins hot on persistent accept errors and instead backs off with a capped delay (#757).
• Wildcard separator handling. wildcard.CompileWithSeparator now properly regex-quotes the separator, and trailing-separator handling plus bare ** behavior are now correct (#752, [#754]).
• Shutdown handler. The /_shutdown handler can no longer block forever on repeated POSTs (#755).
• Rego policy reload race. Fixed a data race on env.regoPolicy between startup and the timed-reload goroutine (#760).
• Cipher-suite parsing. Deduplicated cipher-suite parsing logic so the client and server paths can no longer drift (#759).
• Target and status flag validation. Server mode now correctly rejects --target systemd: and --target launchd: at startup instead of accepting them and failing to dial later (#758), other undialable --target networks are now rejected at flag validation, and --status https:// is now rejected on non-TCP listeners (#762).
• ACME renewal under mTLS. Improved ACME certificate renewal when the listener is configured for mTLS (#743).
• Landlock UNIX-socket FS rules. Fixed Landlock silently dropping filesystem rules for UNIX socket paths (#742).
• Client mode UNIX socket unlink. Client mode no longer unlinks a UNIX socket that is managed by systemd or launchd socket activation (#745).
• Workload API flag validation. --use-workload-api is now rejected when combined with file-based credential flags (#744).
• Systemd socket activation. Fixed a bug where systemd socket activation could not be used for the listen and status sockets at the same time.

Code Quality Changes

• Landlock upgrade. Switched to the Landlock V8 ABI and added IgnoreIsMissing handling so Ghostunnel logs cleanly and continues without sandboxing on older kernels (#735, [#736]).
• Status HTTP server. Added ReadTimeout/IdleTimeout to the status HTTP server, dropped the now-counterproductive WriteTimeout, and bounded the shutdown context to 5s to avoid goroutine leaks (#761).
• Go version source of truth. Builds now derive the Go toolchain version from go.mod rather than a separately pinned version (#737).

Testing Improvements

• FreeBSD integration tests. Added a FreeBSD job to the GitHub Actions workflow running the full integration test suite, with coverage uploaded to Codecov (#750).
• Windows SCM integration tests. Added integration tests for the new Windows service subcommands and improved the integration test harness's coverage handling. The integration harness can now also run from a configurable temp directory (#746).
• ACME under mTLS regression test. Added integration and unit tests exercising ACME renewal under mTLS so the bug stays fixed (#743).
• Additional unit and integration tests. Broader coverage for error paths, corner cases, and previously-untested helpers across multiple packages (#722, [#749]).

Other

• Documentation pass. Proofread and corrected documentation across the site and repo, expanded the security/deployment docs, added Windows service docs, and expanded launchd docs with KeepAlive, reload, and shutdown notes (#734, [#747]).
• Release workflow modernized. Releases are now built with the gh CLI instead of the deprecated GitHub release actions (#733).
• Dependency upgrades. OPA upgraded to v1.17.0, plus various other Go and GitHub Actions dependency bumps via Dependabot (#731, [#738], [#739], [#740], [#741]).

New Flags

New Subcommands