Your Burrow runs on your own machine. When that machine sits behind a home router, a company firewall, or a connection your provider shares between customers, there is no address the outside world can reach it on. The relay gives you one.
How it works#
Your Burrow opens a connection outward to RatelKey and keeps it open. Because your Burrow starts that connection, nothing has to be opened on your router and no address has to stay the same.
Your Burrow is then reachable at its own address:
https://<your-burrow-id>.ratelrelay.com
When someone opens that address, RatelKey passes the connection down to your Burrow and your Burrow answers it.
Your traffic stays yours#
The encrypted connection runs from the browser all the way to your Burrow. RatelKey moves the sealed traffic between the two and it is your Burrow, on your machine, that unseals it.
That works because your Burrow holds its own certificate for its own address. It generates the private key itself, and the key stays on your machine. RatelKey requests the certificate from a public certificate authority, and only for the name your Burrow is entitled to. So the certificate proves your Burrow and nothing else, and what travels through RatelKey is encrypted to a key RatelKey does not have.
Certificates renew themselves#
Your Burrow asks for a certificate the first time it connects and renews it well before it expires. There is nothing to install, configure, or remember.
If a renewal cannot complete, your Burrow keeps serving the certificate it already has and tries again, so a temporary problem does not interrupt access.
When the relay is used#
While the relay is on, your Burrow can always be reached at its relay address, alongside any direct address it has. A connection to a direct address goes straight to your Burrow, and a connection to the relay address goes through RatelKey.
A direct connection is faster, so it is worth forwarding a port if your network allows it. The relay is there for when it does not.
Machines and applications#
Machines that read secrets can use the relay too. When you enrol a machine, you choose how it checks who it is talking to. With Encrypted + verified, the machine checks your Burrow's identity, so it will only talk to your Burrow and will notice if anything else answers. With Encrypted, the default, the connection is still encrypted, but the machine does not check which Burrow answers.
Turning it off#
The relay is optional. You can turn it off in your Burrow's settings under Remote access, and your Burrow will stay reachable on your own network and on any address you have set up yourself.