Gateways

Gateways is the heart of the console: one row per gateway, with a detail page per gateway where you manage its targets, domains, relays, and sessions remotely.

The list has two tabs. Personal shows gateways enrolled under your own account; Team shows gateways that you or a teammate shared into a team you belong to. Each row shows the gateway's name, an online dot, when it last synced, and its target and session counts.

Creating a gateway

Click + Add gateway. The dialog walks you through the two halves:

1. Install the gateway on the target machine — the one-line installer, also covered in Install.
2. Generate setup. Enter a hostname (for example home — it labels the gateway and must be unique within your account) and click Generate setup. The console assigns your relay set and returns a one-time setup blob and PIN, plus the full command that combines them:

burrowee gateway bootstrap <blob> <pin>

Run that on the gateway machine, or paste the blob and PIN into the gateway's local console under Relays → Pair a relay. The PIN is shown once.

The blob is safe to send over any channel — it is useless without the PIN. Until the gateway completes its bootstrap, the row shows a Setup pending badge; clicking it opens Complete setup, which regenerates a fresh blob and PIN on the spot. Generate as many as you need; only the latest counts.

Your plan caps how many active gateways you can have. At the cap, the + Add gateway button is replaced by a "Gateway limit reached" note.

The gateway detail page

Click a gateway's name to open its detail page.

Header. The gateway's display name (click it to rename — up to 64 characters; renames sync down to the gateway, and a rename made in the local console syncs up here), its key fingerprint, a live/offline indicator, and when it last synced. Chips on the right show target, session, and relay counts.

Relays panel. Click the relays chip to expand the full set of relays carrying this gateway — kind (system or edge), host, and whether each is reachable. To put one of your own edge relays on this list, mint an add-blob from the Edge relays page and paste it into the gateway's local console.

The targets table

The Targets section is the main surface: one row per target the gateway exposes, with columns for name, local address, protocol, domains, TLS, sessions, and actions. A filter strip scopes the table to targets with Custom domains, Random domains, or Domainless ones, with counts per bucket; a meter shows your random-domain quota (used / limit).

Per row you can:

• Rename the target — click its name and type. Renaming carries the target's sessions and domains with it.
• Change the protocol in place — click the protocol badge and pick auto, http, https, or raw. Always change it in place; deleting and recreating a target kills its sessions.
• Deactivate / Activate — pause a target without losing its configuration. If the gateway is offline the change is saved and shows a pending apply badge until the gateway reconnects.
• Delete — a double-confirm dialog that spells out the cost: the target is removed, all its sessions are revoked, and any random domain it held is released. You must tick "I understand" first.

Domains, per target

The Domains cell lists what is attached to the target — custom domains first, then its random *.burrowee.net name:

• Claim a random domain (quota-gated) or attach a custom domain via Assign domain. Attaching a custom domain that currently lives on another target moves it here — the certificate carries over, so TLS is uninterrupted.
• + Add domain opens the custom-domain dialog pre-scoped to this target.
• The lock icon shows TLS readiness; the ⓘ icon opens a per-domain relay picker — Auto serves the domain on every relay the gateway connects through, or pin it to one of your edge relays. (Random domains are wildcard-issued and always serve on all relays.)
• The globe icon toggles the domain public. A public domain serves with no session token — anyone who can reach the hostname reaches the service — so making one public asks you to confirm. Toggling back to private is immediate.
• The ✕ detaches a custom domain or releases a random one (confirm required).

A target on the shared relay fleet with no domain at all shows a disconnected badge — it is not reachable in a browser until you assign one (or, if your quota is spent, take over a random domain from another target).

Sessions, per target

Each target row's N sessions button expands its own session list, with an inline create row to mint new ones. The full session model — minting, TTLs, sharing, page-shares — is on the Sessions page. When the gateway is offline, the sessions view is unavailable: sessions are live gateway state, and the mirror would be stale.

Sharing a gateway into a team

Each row on the Personal tab has a Share button. Pick one of your teams and the gateway appears on every member's Team tab, with their access governed by their team role. Team sharing requires the Pro or Team plan.