Install the outbound connector on your application server

Host placement

Run one connector on a Linux or Windows server whose Docker network can reach the private applications you intend to register. Gatehouse does not require the connector to run on the same host, only on a permitted network path.

• No public IP required
• No inbound port mapping
• Outbound TCP 443 required
• Keep Docker and the host patched

Download and inspect

Download the archive from this page. Review Dockerfile, docker-compose.yml, .env.example, and the connector source before operating it in a sensitive environment.

curl -fLO https://gatehousebox.com/downloads/gatehouse-connector.zip
sha256sum gatehouse-connector.zip
unzip gatehouse-connector.zip -d gatehouse-connector

Create the one-time enrollment

Sign in, open Connectors, name the connector for its location or trust boundary, and select Generate token. The token expires after 30 minutes and becomes invalid immediately after successful exchange.

Configure the three enrollment values

Copy .env.example to .env and paste the values displayed by the console. The public relay and enrollment endpoints are fixed for Gatehousebox.

RELAY_URL=wss://relay.gatehousebox.com/tunnel/connectors
ENROLL_URL=https://relay.gatehousebox.com/api/enroll
CONNECTOR_ENROLLMENT_TOKEN=gh_enroll_…

Start and observe

Compose builds the .NET worker locally and starts it with a private credential volume. Follow structured logs until enrollment and the persistent tunnel both succeed.

docker compose up -d --build
docker compose ps
docker compose logs -f --tail=100 connector

Credential lifecycle

After enrollment, the connector writes connector-credential.json to /data in the connector-data volume and no longer needs the one-time token. Revoking the connector invalidates the server-side credential hash.

• Do not copy the credential to another host
• Back up configuration, not connector identity
• Enroll a replacement when moving hosts
• Revoke identities that are no longer used

Reach applications correctly

For an application on the Docker host, use host.docker.internal. For another Compose project, attach the connector to a shared external network and register the application container name.

docker network create gatehouse-private
# Attach both the application and connector to gatehouse-private
# Register target host: grafana, target port: 3000

Upgrade and remove

Download the current bundle, review the source diff, rebuild the image, and restart. To retire a connector, revoke it in Gatehouse before removing the container and local credential volume.

docker compose pull --ignore-buildable
docker compose up -d --build
# Retire only after revocation:
docker compose down -v