From 698a70e9fe4ab9489ab72fb92b0432f81ef10750 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Sun, 12 Jul 2026 20:56:34 +0530
Subject: [PATCH 1/2] ghostunnel: use finalAttrs

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 pkgs/by-name/gh/ghostunnel/package.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gh/ghostunnel/package.nix b/pkgs/by-name/gh/ghostunnel/package.nix
index 9af77d72cbd5..a32d9bcb62f1 100644
--- a/pkgs/by-name/gh/ghostunnel/package.nix
+++ b/pkgs/by-name/gh/ghostunnel/package.nix
@@ -3,17 +3,16 @@
   fetchFromGitHub,
   lib,
   nixosTests,
-  ghostunnel,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "ghostunnel";
   version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "ghostunnel";
     repo = "ghostunnel";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BntQCauAgnaiNn31nrVEsHFvQv7zK6D0z/rInbCVTr0=";
   };
 
@@ -41,13 +40,13 @@ buildGoModule rec {
     imports = [
       (lib.modules.importApply ./service.nix { })
     ];
-    ghostunnel.package = ghostunnel; # FIXME: finalAttrs.finalPackage
+    ghostunnel.package = finalAttrs.finalPackage;
   };
 
   meta = {
     description = "TLS proxy with mutual authentication support for securing non-TLS backend applications";
     homepage = "https://github.com/ghostunnel/ghostunnel#readme";
-    changelog = "https://github.com/ghostunnel/ghostunnel/releases/tag/v${version}";
+    changelog = "https://github.com/ghostunnel/ghostunnel/releases/tag/${finalAttrs.src.rev}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       roberth
@@ -55,4 +54,4 @@ buildGoModule rec {
     ];
     mainProgram = "ghostunnel";
   };
-}
+})

From 57b0e5e80312888f5db8b1581cd96fa44a5cd9a9 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Mon, 13 Jul 2026 13:07:06 +0530
Subject: [PATCH 2/2] nixosTests.ghostunnel-modular: fix test

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 pkgs/by-name/gh/ghostunnel/service.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/gh/ghostunnel/service.nix b/pkgs/by-name/gh/ghostunnel/service.nix
index 52a2f4016e79..67e2ba60add4 100644
--- a/pkgs/by-name/gh/ghostunnel/service.nix
+++ b/pkgs/by-name/gh/ghostunnel/service.nix
@@ -187,6 +187,9 @@ in
     process = {
       argv = [
         (getExe cfg.package)
+        # ghostunnel's landlock rules don't like reading the CA certs from /etc
+        # because they are links to /nix/store, which isn't part of its rules
+        "--disable-landlock"
         "server"
         "--listen"
         cfg.listen