Gateway

The gateway is the Burrowee component you run on the machine you want to reach. It sits next to your services — the dev server on port 3000, the SSH daemon, the database — dials out to a relay over WSS, and stays connected. Nothing ever connects inbound to your machine; when a request arrives through the relay, the gateway decrypts it, talks to the local service, and encrypts the reply.

Three things make the gateway the centre of gravity in Burrowee:

• It is the sole verifier. Every session token, every share link, every paired CLI client is checked by the gateway itself, against keys generated on your machine that never left it. Relays forward ciphertext they cannot read, and the cloud console signs credentials but is not on the data path.
• It owns its targets and sessions locally. The list of what is exposed (targets) and who may reach it (sessions, paired clients) lives in the gateway's own store under ~/.burrowee/gateway/. The cloud console only mirrors that state and remote-controls it through the relay — if the console is unreachable, your gateway keeps serving.
• It carries its own management UI. A local web console on http://127.0.0.1:16518 (loopback only) is always available on the gateway machine itself.

If you haven't installed the gateway yet, start with the install guide, then come back here for pairing.

Commands at a glance

You normally invoke the gateway through the burrowee dispatcher as burrowee gateway <command>; calling the burrowee-gateway binary directly is equivalent.

Command	What it does
burrowee gateway	Run the gateway daemon in the foreground (the managed service runs this for you)
burrowee gateway bootstrap <blob> <pin>	First-time setup: persist relays + enroll, then set up + start the service and open the console
burrowee gateway add <blob> <pin>	Add a console-minted relay to an already-enrolled gateway
burrowee gateway console	Open the local console in the browser
burrowee gateway status	Show service + live gateway status
burrowee gateway doctor [--fix] [--yes]	Diagnose identity/service/relay/console; --fix repairs the service
burrowee gateway service install|status	Manage the launchd/systemd unit
burrowee gateway restart	Restart the managed service
burrowee gateway uninstall [--purge]	Remove the service; back up (or --purge) config + state
burrowee gateway version	Print the version

Flags on the daemon (serve) path: --home <dir> (default ~/.burrowee/gateway), --console off, --no-open.

In this section

• Pairing — claim a gateway into your account with a setup blob and PIN.
• Targets — define what the gateway exposes, and how the four handler types work.
• Local console — a tour of the gateway's built-in web UI.
• Sessions — full and page-share sessions: mint, extend, revoke, share.
• Service & restart — running the gateway as a managed service, logs, uninstall.