Appearance
Targets
A target is one thing your gateway exposes: a name, a local address, and a handler type that says how the gateway should speak to it.
| Field | Meaning |
|---|---|
| Name | How the outside refers to it. CLI clients connect by this name (burrowee cli connect --svc <name>), and web domains attach to it. |
| Target | The local address the gateway forwards to, in host:port form — 127.0.0.1:3000, 127.0.0.1:22, or another machine on the gateway's LAN. |
| Handler type | One of auto, http, https, raw — see below. |
| Active | A toggle. An inactive target keeps its configuration and sessions but is not served until you switch it back on. |
You create and manage targets in the local console (the Targets tab — name it, point it at the local address, pick a type), or remotely from the cloud console's gateway detail page, which relays the same operations down to the gateway. Either way, the gateway's own store is where the target actually lives.
Handler types
The handler type tells the gateway what protocol the local service speaks, so it can terminate the tunnel correctly.
auto — probe and decide (the default)
auto is for web services when you're not sure (or don't care) whether the local service speaks plain HTTP or HTTPS. The first time a request arrives, the gateway probes the local address once: if it answers TLS, the target behaves as https; if it answers plaintext, as http. The result is cached, and the cache self-corrects — if the service was down during the probe, or later changes scheme, the gateway re-probes rather than serving a stale answer. If you leave the handler type empty when creating a target, you get auto.
http — plain web service
The local service speaks unencrypted HTTP (a typical dev server on 127.0.0.1:3000). The gateway pipes the decrypted request bytes straight through. Don't worry about the "unencrypted" — that's only the last hop on the gateway machine itself; everything between the viewer and the gateway is end-to-end encrypted.
https — local service with its own TLS
The local service itself serves TLS (many self-hosted apps and admin panels do, often with a self-signed certificate). The gateway re-encrypts to the local service so the hop completes; self-signed certificates on loopback addresses are accepted.
raw — an opaque byte pipe
raw does no protocol handling at all: bytes in, bytes out. Use it for anything that isn't web — SSH, databases, RDP, game servers, custom TCP protocols. This is the type CLI clients use with burrowee cli connect and burrowee cli ssh. (You may see the older spelling raw-forward in existing setups; it means the same thing and is accepted everywhere raw is.)
Changing a target's type
You can change a target's handler type in place — the Protocol control on the target row in either console. The change applies to new connections immediately; an auto target also drops its cached probe result and re-probes.
Change the type in place — never delete and recreate
Deleting a target permanently deletes every session minted for it. If you delete a target and recreate it under the same name to change its type, all existing share links and viewer sessions for it die immediately with an invalid-token error. Use the in-place protocol change instead; it leaves sessions intact.
Domains
A web target becomes reachable in a browser once a domain points at it — either an auto-assigned *.burrowee.net address from the random-domain pool or a custom domain of your own (say app.example.com). Domains are managed by the cloud console (which owns DNS and certificates) and attached per target; the local console's Domains column shows what's attached and links you to the management page. See the console guide for the domain and certificate flow.