diff --git a/Makefile b/Makefile
index 96a9129..6665c5e 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ MANDIR = share/man
 all: tlstunnel tlstunnel.1
 
 tlstunnel:
-	$(GO) build $(GOFLAGS) .
+	$(GO) build $(GOFLAGS) ./cmd/tlstunnel
 tlstunnel.1: tlstunnel.1.scd
 	$(SCDOC) <tlstunnel.1.scd >tlstunnel.1
 
diff --git a/main.go b/cmd/tlstunnel/main.go
similarity index 87%
rename from main.go
rename to cmd/tlstunnel/main.go
index c07389d..97487e3 100644
--- a/main.go
+++ b/cmd/tlstunnel/main.go
@@ -7,6 +7,8 @@ import (
 	"net"
 	"net/url"
 	"strings"
+
+	"git.sr.ht/~emersion/tlstunnel"
 )
 
 var configPath = "config"
@@ -15,12 +17,12 @@ func main() {
 	flag.StringVar(&configPath, "config", configPath, "path to configuration file")
 	flag.Parse()
 
-	cfg, err := LoadConfig(configPath)
+	cfg, err := tlstunnel.LoadConfig(configPath)
 	if err != nil {
 		log.Fatalf("failed to load config file: %v", err)
 	}
 
-	srv := NewServer()
+	srv := tlstunnel.NewServer()
 
 	for _, d := range cfg.Children {
 		var err error
@@ -44,8 +46,8 @@ func main() {
 	select {}
 }
 
-func parseFrontend(srv *Server, d *Directive) error {
-	frontend := &Frontend{Server: srv}
+func parseFrontend(srv *tlstunnel.Server, d *tlstunnel.Directive) error {
+	frontend := &tlstunnel.Frontend{Server: srv}
 	srv.Frontends = append(srv.Frontends, frontend)
 
 	// TODO: support multiple backends
@@ -83,7 +85,7 @@ func parseFrontend(srv *Server, d *Directive) error {
 	return nil
 }
 
-func parseBackend(backend *Backend, d *Directive) error {
+func parseBackend(backend *tlstunnel.Backend, d *tlstunnel.Directive) error {
 	var backendURI string
 	if err := d.ParseParams(&backendURI); err != nil {
 		return err
@@ -117,7 +119,7 @@ func parseBackend(backend *Backend, d *Directive) error {
 	return nil
 }
 
-func parseTLS(srv *Server, d *Directive) error {
+func parseTLS(srv *tlstunnel.Server, d *tlstunnel.Directive) error {
 	for _, child := range d.Children {
 		switch child.Name {
 		case "acme_ca":
diff --git a/config.go b/config.go
index 24996c0..fca27ec 100644
--- a/config.go
+++ b/config.go
@@ -1,4 +1,4 @@
-package main
+package tlstunnel
 
 import (
 	"bufio"
diff --git a/server.go b/server.go
index f9e5aab..3f90eeb 100644
--- a/server.go
+++ b/server.go
@@ -1,4 +1,4 @@
-package main
+package tlstunnel
 
 import (
 	"context"
@@ -16,9 +16,9 @@ type Server struct {
 	Listeners    map[string]*Listener // indexed by listening address
 	Frontends    []*Frontend
 	ManagedNames []string
-	ACMEManager *certmagic.ACMEManager
+	ACMEManager  *certmagic.ACMEManager
 
-	certmagic   *certmagic.Config
+	certmagic *certmagic.Config
 }
 
 func NewServer() *Server {