stunnel TLS Proxy on Ubuntu 24.04 LTS

stunnel is a TLS proxy that wraps an existing plaintext TCP service in encryption without any change to that service. In server mode it accepts TLS connections and forwards the decrypted stream to a local or remote backend. In client mode it does the reverse, accepting plaintext locally and speaking TLS outwards. That makes it the standard way to put modern, hardened TLS in front of a database, a legacy application, an appliance, or anything else that has no encryption of its own. This cloudimg image runs stunnel 5.79, built from the pinned upstream source on Ubuntu 24.04 LTS with the tarball verified against the upstream published SHA-256 at build time, ready to use on first boot.

stunnel runs under systemd as an unprivileged system user, with a TLS 1.2 minimum floor and the capability to bind privileged ports so a tunnel can be moved to port 443 without editing the unit. Two tunnels ship enabled and working: a pre-shared-key protected TLS tunnel on TCP port 8443, and a certificate-based TLS termination endpoint on TCP port 8444. Both are wired to the VM's own SSH service as a working demonstration backend, and you repoint them at your own service by changing one line in a short, commented configuration file and reloading. Adding further tunnels is a matter of copying a section.

Security is built in. No key material of any kind ships inside the image, so no two deployments ever share a secret: on first boot every VM generates its own 256-bit pre-shared key and its own TLS certificate and private key, and records them in a root-only file for the operator. The daemon is held behind a bootstrap gate until that has completed, so it can never start with missing or shared key material. On the default tunnel the pre-shared key is checked during the TLS handshake itself, so a client that does not hold this VM's identity and key is rejected before a single byte reaches the backend.

stunnel is distributed under the GNU General Public License version 2 or later, with the copyright holder's explicit exception permitting linking with OpenSSL. It is free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the stunnel project. cloudimg provides packaging, per instance key material automation, a secure default configuration, security patching, and 24/7 support with a guaranteed 24 hour response SLA.