diff --git a/contrib/tlstunnel.md b/contrib/tlstunnel.md
new file mode 100644
index 0000000..9ae2a4e
--- /dev/null
+++ b/contrib/tlstunnel.md
@@ -0,0 +1,22 @@
+# Setting up tlstunnel with soju
+
+[tlstunnel] can be used in front of soju to take care of TLS.
+
+## tlstunnel configuration
+
+```
+frontend {
+	listen irc.example.org:6697
+	backend tcp+proxy://localhost:6667
+	protocol irc
+}
+```
+
+## soju configuration
+
+```
+listen irc+insecure://localhost
+accept-proxy-ip localhost
+```
+
+[tlstunnel]: https://git.sr.ht/~emersion/tlstunnel