Ghostunnel is a simple mutual-TLS proxy that secures non-TLS backend services, with certificate-based access control, hot reloading and HSM support.