Appearance
CLI
The Burrowee CLI is the client you connect from. It is a small binary (burrowee-cli) with two jobs: it pairs your machine with a gateway, and it acts as a local forwarder — it listens on a local TCP port, opens an encrypted carrier to a relay, completes the per-service end-to-end handshake with the gateway, and pipes your local connection through. Ordinary tools like ssh, curl, or your browser just talk plain TCP to localhost; the CLI owns the transport and the crypto.
You normally reach it as burrowee …: the bare burrowee command is the universal dispatcher, which forwards anything it doesn't recognize to burrowee-cli. Everything on these pages works the same whether you type burrowee connect or burrowee-cli connect.
Commands at a glance
| Command | What it does |
|---|---|
bootstrap <blob> <pin> | First-time setup: pair with a gateway |
relays pair <blob> <pin> | Pair a console-minted relay into an already-enrolled client. |
connect --svc <s> [flags] | Forward a local TCP port through the relay to a service |
ssh --svc <s> [ssh args…] | Connect, then exec ssh against the forwarded port |
daemon [flags] | Run the long-running transport daemon (unix only) |
relays <list|use|priority|pair|probe> | List relays, switch the default, set failover priority, pair a new relay, or probe connectivity. |
doctor [--fix] [--yes] | Run read-only health checks (--fix: thin remediations) |
service <install|status> | Install or inspect the managed daemon service |
restart | Restart the managed daemon service |
uninstall [--purge] | Back up state + clear the socket (--purge deletes all) |
status | Summarize the service, daemon, and version state. |
update [--dry] [--force] | Update to the latest release (--dry reports only; --force reinstalls even if already current). |
version | Print the version |
Run burrowee --help to see this list plus every flag in your terminal.
Where the CLI keeps its state
Everything lives in one directory, ~/.burrowee/cli/, written by bootstrap. There are no environment variables to set.
| File | Contents |
|---|---|
config.json | Gateway ID, relay list (with LAN origins and the default relay), and paths to the two key files |
gw.pub | The gateway's Ed25519 public key, hex-encoded |
psk.bin | Your per-client service PSK, raw bytes (file mode 0600) |
You rarely need to touch these by hand: connect and ssh read them automatically, relays use, relays priority, and relays pair rewrite config.json for you, and uninstall backs the whole directory up when you want it gone.
Where to next
- Bootstrap — pair with your gateway.
- Connect & SSH — open your first session.
- Daemon & service — keep a warm connection running in the background.
- Relays — manage multiple relays and LAN-first dialing.