Burrowee Docs

Appearance

Install the gateway ​

Install the gateway on the machine you want to reach — the home server, office box, or VM whose services you are exposing. The gateway dials out to a relay (no inbound ports to open), serves your targets, and holds the end-to-end keys, so relays never see your traffic in the clear.

sh
curl -fsSL --proto '=https' --tlsv1.2 https://release.burrowee.com/gateway/install.sh | sh

The installer detects your OS and architecture, downloads the latest gateway release, verifies it (minisign signature, then SHA-256 — see the install overview for the full chain), and installs six binaries into $PREFIX/bin (default ~/.local/bin):

  • burrowee — the universal dispatcher; burrowee gateway … runs whichever of the two binaries below the verb needs.
  • burrowee-gateway — the gateway daemon: serves the gateway itself and handles run/update/version. It also starts and supervises the local console as a child process.
  • burrowee-gateway-cli — every other gateway verb (bootstrap, status, doctor, target, service, relays, push, …). The dispatcher routes these here automatically, so burrowee gateway bootstrap … works exactly as shown below.
  • burrowee-gateway-console — the loopback-only local console, run as its own process; burrowee gateway console opens it in a browser.
  • burrowee-register — a helper that bridges a plain TCP service into the gateway as a named service.
  • burrowee-gateway-updater — a standalone agent that applies console-pushed updates, installed as its own service alongside the gateway.

If ~/.local/bin is not on your PATH, the installer says so and prints the line to add:

sh
export PATH="$HOME/.local/bin:$PATH"

First run ​

On a fresh interactive install (a real terminal, not CI), the installer offers to set the gateway up on the spot:

Set up now? Paste the setup blob + PIN from the console (Enter to skip).
blob>

Create the gateway in the console first — that is what mints the setup blob and PIN. Paste both at the prompt and the installer runs burrowee gateway bootstrap for you. Press Enter to skip and do it later:

sh
burrowee gateway bootstrap <blob> <pin>

Two cases where the prompt does not appear:

  • Already set up — if ~/.burrowee/gateway/ exists with state in it (the gateway's database and keys), re-installing never re-prompts; the binaries are simply updated in place.
  • No terminal (CI, a provisioning script, an SSH one-shot) — the installer just prints the bootstrap command as your next step.

Platform notes ​

  • macOS: every release is verified via minisign + SHA-256 before install (see the install overview); the binaries themselves are ad-hoc signed, not Developer ID signed or notarized, but since they arrive via curl | sh rather than a browser download, macOS never sets the quarantine attribute in the first place — the installer strips it defensively anyway. If you ever place a binary on PATH by hand and macOS blocks it: xattr -d com.apple.quarantine ~/.local/bin/burrowee-gateway.
  • Linux: a preflight step tries to install minisign, unzip, and curl for you via your package manager (root if available); if that's not possible, install them yourself (apt-get install minisign unzip or your distro's equivalent) — verification is mandatory and the installer aborts without them. Skip preflight with BURROWEE_SKIP_PREFLIGHT=1.
  • The gateway runs as a managed service (launchd on macOS, systemd on Linux) once bootstrapped — see Service & restart.

Next step ​

Bootstrap the gateway with its setup blob and pair your first client: Gateway pairing.