Documentation

BlueSkyGate connects your gateways over an encrypted overlay. A gateway is a single static binary; the control plane coordinates identity, routing, and key rotation. This guide gets a two-node overlay running in a few minutes.

Quickstart

1. Create a project and download your enrollment token from the dashboard.
2. Install the bsg agent on each gateway.
3. Enroll each gateway with the token; it dials the control plane and joins the mesh.
4. Define a routing policy and apply it.

Install a gateway

Linux (amd64/arm64):

curl -fsSL https://get.blueskygate.net/install.sh | sh
bsg version

The agent installs as a systemd service and runs unprivileged after the first start.

Join the overlay

bsg enroll --token "$BSG_TOKEN" --name edge-fra-01
bsg status

Once enrolled, the gateway holds an outbound tunnel to the control plane. No inbound ports are opened on the host.

Routing policy

Policies are declarative and version-controlled. Example: expose an internal service to a tagged group only.

route "internal-api" {
  to      = "10.20.0.10:8080"
  allow   = ["group:engineering"]
  exposed = false
}

Apply with bsg apply policy.hcl. Changes roll out atomically across the mesh.

CLI reference

FAQ

Does BlueSkyGate see my traffic? No. The overlay carries your traffic end-to-end; we coordinate identity and routing, not payloads.

What happens if the control plane is unreachable? Existing tunnels keep forwarding. New peers can't join until connectivity is restored.

Need help? Contact us.