Install the gateway

Install the gateway on the machine you want to reach — the home server, office box, or VM whose services you are exposing. The gateway dials out to a relay (no inbound ports to open), serves your targets, and holds the end-to-end keys, so relays never see your traffic in the clear.

curl -fsSL --proto '=https' --tlsv1.2 https://release.burrowee.com/gateway/install.sh | sh

The installer detects your OS and architecture, downloads the latest gateway release, verifies it (minisign signature, then SHA-256 — see the install overview for the full chain), and installs six binaries into the root-owned exec root /usr/local/burrowee/bin:

• burrowee — the universal dispatcher; burrowee gateway … runs whichever of the two binaries below the verb needs.
• burrowee-gateway — the gateway daemon: serves the gateway itself and handles run/serve/version. It also starts and supervises the local console as a child process.
• burrowee-gateway-cli — every other gateway verb (bootstrap, status, doctor, target, service, relays, push, updater, …). The dispatcher routes these here automatically, so burrowee gateway bootstrap … works exactly as shown below.
• burrowee-gateway-console — the loopback-only local console, run as its own process; burrowee gateway console open opens it in a browser.
• burrowee-register — a helper that bridges a plain TCP service into the gateway as a named service.
• burrowee-gateway-updater — a standalone agent that applies console-pushed updates, installed as its own service alongside the gateway.

There is one install destination — /usr/local/burrowee/bin, root-owned — and no per-user prefix: the gateway runs as a system service whose units name these binaries absolutely, and a binary a root service runs must live where no unprivileged user can rewrite it. Setting PREFIX is refused rather than silently overridden. Steps that touch system paths elevate via sudo, prompting when needed.

That directory is not on your PATH, and the installer never edits your shell to put it there. Instead, the last thing a successful install prints is the line that adds it for your login shell and the profile file that makes it permanent — run both before the commands below, or type them by full path (/usr/local/burrowee/bin/burrowee gateway …) until you do. The block, per shell: Put the exec root on PATH.

Upgrading from a pre-0.2.0 install

Installs and updates run the gateway's migrations as part of the install, and the installer never writes service units or swaps binaries unless the migration can complete:

• A per-user gateway tree from 0.1.x (~/.burrowee/gateway/) is adopted one-way into the system config/data roots, sourcing only from the running user's home. See Service & restart for the roots.
• Stale copies of the binaries that would shadow the fresh ones are swept: pre-0.2.0 per-user copies (e.g. under ~/.local/bin), which the installer asks about per file, and the 0.2-era binaries and symlinks an earlier installer left in /usr/local/bin. After removing a shadowing copy it tells you how to clear your shell's stale command hash (e.g. hash -r).

If this machine ended up on a newer version without the installer's migrations running (hand-placed binaries, a missing/wrong version anchor, or a rebuilt binary on the same version), repair it with the hosted upgrade one-liner — it re-installs and then force-runs every migration the release carries, regardless of what the host recorded:

curl -fsSL https://release.burrowee.com/gateway/upgrade.sh | sh               # force the whole shipped ladder
curl -fsSL https://release.burrowee.com/gateway/upgrade.sh | sh -s -- 0.2.0   # force the 0.2.0-and-newer migrations

The optional argument is the inclusive migration floor ("assume this host is below it") — it selects which migrations are forced and never changes which release installs (always the newest). Details: Upgrading.

First run

On a fresh interactive install (a real terminal, not CI), the installer offers to set the gateway up on the spot:

Set up now? Paste the setup blob + PIN from the console (Enter to skip).
blob>

Create the gateway in the console first — that is what mints the setup blob and PIN. Paste both at the prompt and the installer runs burrowee gateway bootstrap for you. Press Enter to skip and do it later:

burrowee gateway bootstrap <blob> <pin>

Two cases where the prompt does not appear:

• Already set up — if the machine already holds gateway state (identity keys or the gateway database, under the system roots or a legacy per-user tree), re-installing never re-prompts; the binaries are simply updated in place.
• No terminal (CI, a provisioning script, an SSH one-shot) — the installer just prints the bootstrap command as your next step.

Platform notes

• macOS: every release is verified via minisign + SHA-256 before install (see the install overview); the binaries themselves are ad-hoc signed, not Developer ID signed or notarized, but since they arrive via curl | sh rather than a browser download, macOS never sets the quarantine attribute in the first place — the installer strips it defensively anyway. If you ever place a binary on PATH by hand and macOS blocks it: xattr -d com.apple.quarantine /usr/local/burrowee/bin/burrowee-gateway.
• Linux: a preflight step tries to install minisign, unzip, and curl for you via your package manager (root if available); if that's not possible, install them yourself (apt-get install minisign unzip or your distro's equivalent) — verification is mandatory and the installer aborts without them. Skip preflight with BURROWEE_SKIP_PREFLIGHT=1. On an update, the installer restarts the running daemon so the new binary takes effect; set BURROWEE_NO_RESTART=1 to stage the units without (re)starting them.
• The gateway runs as a managed system service (launchd on macOS, systemd on Linux) once bootstrapped — see Service & restart.

Next step

Bootstrap the gateway with its setup blob and pair your first client: Gateway pairing.