Your Burrow runs on your own machine. When that machine sits behind a home router, a company firewall, or a connection your provider shares between customers, there is no address the outside world can reach it on. The relay gives you one.
How it works#
Your Burrow opens a connection outward to RatelKey and keeps it open. Because your Burrow starts that connection, nothing has to be opened on your router and no address has to stay the same.
Your Burrow is then reachable at its own address:
https://<your-burrow-id>.ratelrelay.com
When someone opens that address, RatelKey passes the connection down to your Burrow and your Burrow answers it.
Your traffic stays yours#
The encrypted connection runs from the browser all the way to your Burrow. RatelKey moves the sealed traffic between the two and it is your Burrow, on your machine, that unseals it.
That works because your Burrow holds its own certificate for its own address. It generates the private key itself, the key stays on your machine, and RatelKey only ever signs a request for the name your Burrow is entitled to. So the certificate proves your Burrow and nothing else, and what travels through RatelKey is encrypted to a key RatelKey does not have.
Certificates renew themselves#
Your Burrow asks for a certificate the first time it connects and renews it well before it expires. There is nothing to install, configure, or remember.
If a renewal cannot complete, your Burrow keeps serving the certificate it already has and tries again, so a temporary problem does not interrupt access.
When the relay is used#
The relay is a fallback. When your Burrow can be reached directly, connections go straight to it and the relay stays out of the way. Your Burrow works out which applies and switches on its own.
A direct connection is faster, so it is worth forwarding a port if your network allows it. The relay is there for when it does not.
Machines and applications#
Machines that read secrets can use the relay too. A machine checks your Burrow's own certificate, the one it recorded when you enrolled it, so it will only talk to your Burrow and it will notice if anything else answers.
Turning it off#
The relay is optional. You can turn it off in your Burrow's settings under Remote access, and your Burrow will stay reachable on your own network and on any address you have set up yourself.