Twingate

https://www.twingate.com/docs
Admin
Twingate provides secure, zero-trust access to private networks and applications, acting as a modern...
Tokens:564,565
Snippets:4,317
Trust Score:9.9
Update:2 days ago
Show doc for...
Tokens:
Raw
### Run the setup script

Source: https://www.twingate.com/docs/headless-iot-gateway

Executes the downloaded setup script with the service key file and local network CIDR block as parameters. The script installs and configures Bind9, sets up NAT gateway, and installs the Twingate headless client.

```bash
sudo ./gateway_config.sh ./service_key.json 10.0.0.0/24
```

--------------------------------

### Install and Setup Twingate Linux Client in Headless Mode

Source: https://www.twingate.com/docs/linux-headless

Install the Twingate Linux Client and configure it for headless mode using the twingate setup command with the --headless parameter. Requires a service key JSON file at the specified path.

```shell
curl https://binaries.twingate.com/client/linux/install.sh | sudo bash
sudo twingate setup --headless /path/to/service_key.json
```

--------------------------------

### Install Twingate Connector on Droplet

Source: https://www.twingate.com/docs/openclaw-digitalocean

Sets environment variables for Twingate tokens and network, then installs the connector via the setup script. Verifies installation with systemctl status.

```bash
export TWINGATE_ACCESS_TOKEN="your-access-token"
export TWINGATE_REFRESH_TOKEN="your-refresh-token"
export TWINGATE_NETWORK="yourcompany"  # Without .twingate.com

# Install the Connector
curl "https://binaries.twingate.com/connector/setup.sh" | \
  sudo TWINGATE_ACCESS_TOKEN="$TWINGATE_ACCESS_TOKEN" \
  TWINGATE_REFRESH_TOKEN="$TWINGATE_REFRESH_TOKEN" \
  TWINGATE_NETWORK="$TWINGATE_NETWORK" \
  TWINGATE_LABEL_DEPLOYED_BY="openclaw" \
  bash

# Verify
sudo systemctl status twingate-connector
```

--------------------------------

### Pulumi project setup prompts

Source: https://www.twingate.com/docs/pulumi-gcp

Example values entered when prompted during project initialization.

```bash
project name: demo

project description: (A minimal TypeScript Pulumi program)

stack name: (dev)
```

--------------------------------

### Provide project details during Pulumi setup

Source: https://www.twingate.com/docs/pulumi-azure

Example values for the Pulumi prompts: project name, description, and stack name.

```bash
project name: demo
project description: Deploying Twingate using Pulumi
stack name: azure
```

--------------------------------

### Install Twingate Windows client in headless mode with PowerShell

Source: https://www.twingate.com/docs/windows-headless

Shows two command-line installation examples: one with silent installation using /qn, and another that also sets the log level to debug. The service_secret switch is required and must point to a valid Service Key file.

```powershell
# Silently install the client in headless mode
TwingateWindowsInstaller.exe service_secret=C:\path\to\service_key.json /qn

# (Optional) Set the log level at installation time
# Note: log_level=info is the default log level
TwingateWindowsInstaller.exe service_secret=C:\path\to\service_key.json log_level=debug /qn
```

--------------------------------

### Install Twingate Windows Client with network, no optional updates, and auto-update

Source: https://www.twingate.com/docs/windows-managed-devices

Command line example that installs the Twingate Windows Client, setting the Twingate Network to beamreach.twingate.com and disabling optional updates. When run on a system with an existing installation, it performs an in-place update and, due to auto_update=true, logs the user back in to their existing session.

```text
TwingateWindowsInstaller.exe /qn network=beamreach.twingate.com no_optional_updates=true auto_update=true
```

--------------------------------

### Install Twingate Linux Client via APT (Ubuntu, Debian)

Source: https://www.twingate.com/docs/linux

Adds the Twingate APT repository and installs the twingate package (or twingate-latest for early release). Requires curl, gpg, and ca-certificates. After installation, run sudo twingate setup to configure the client.

```shell
# ensure that curl, gpg, and ca-certificates are installed
curl -fsSL https://packages.twingate.com/apt/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/twingate-client-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/twingate-client-keyring.gpg] https://packages.twingate.com/apt/ * *" | sudo tee /etc/apt/sources.list.d/twingate.list
apt update -yq
apt install -yq twingate  # or twingate-latest
# After installation, configure the client by running: sudo twingate setup
```

--------------------------------

### Install Docker with convenience script

Source: https://www.twingate.com/docs/connectors-on-linux

Use this shell script to install Docker on any Linux platform. It downloads the official Docker installation script and runs it, then verifies the installation by running the hello-world container.

```shell
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

# Verify Docker is installed and running
sudo docker run hello-world
```

--------------------------------

### Configure Twingate Linux Client with sudo twingate setup

Source: https://www.twingate.com/docs/linux

Interactively configures the Twingate Client after installation. Must be run with sudo.

```shell
sudo twingate setup
```

--------------------------------

### GitHub Actions example for headless Twingate kubeconfig sync

Source: https://www.twingate.com/docs/kubernetes-kubeconfig-sync

GitHub Actions workflow that installs Twingate, starts the headless client using the TWINGATE_SERVICE_KEY secret, and syncs kubeconfig to deploy. The workflow triggers on push events.

```yaml
name: Deploy to Kubernetes
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Twingate
        run: |
          echo "deb [trusted=yes] https://packages.twingate.com/apt/ /" | sudo tee /etc/apt/sources.list.d/twingate.list
          sudo apt update -yq
          sudo apt install -yq twingate

      - name: Start Twingate headless
        env:
          TWINGATE_SERVICE_KEY: ${{ secrets.SERVICE_KEY }}
        run: |
          echo $TWINGATE_SERVICE_KEY | sudo twingate setup --headless=-
          sudo twingate start

      - name: Sync kubeconfig and deploy
        run: |
          twingate kube config sync
          kubectl --context=my-cluster get pods
```

--------------------------------

### CircleCI example for headless Twingate kubeconfig sync

Source: https://www.twingate.com/docs/kubernetes-kubeconfig-sync

YAML configuration for a CircleCI job that installs Twingate, starts the headless client with a Service Key, and syncs kubeconfig to deploy to Kubernetes. Requires the SERVICE_KEY environment variable set in CircleCI project settings.

```yaml
jobs:
  deploy:
    docker:
      - image: cimg/base:current
    steps:
      - checkout

      - run:
          name: Install Twingate
          command: |
            echo "deb [trusted=yes] https://packages.twingate.com/apt/ /" | sudo tee /etc/apt/sources.list.d/twingate.list
            sudo apt update -yq
            sudo apt install -yq twingate

      - run:
          name: Start Twingate headless
          command: |
            echo "$SERVICE_KEY" | sudo twingate setup --headless=-
            sudo twingate start

      - run:
          name: Sync kubeconfig and deploy
          command: |
            twingate kube config sync
            kubectl --context=my-cluster get pods
```

--------------------------------

### Copy Example Configuration File

Source: https://www.twingate.com/docs/diy-vpn-setup-guide

Copies the example values file to values.yaml for editing.

```bash
cp values-example.yaml values.yaml
```

--------------------------------

### Create a startup script for the web server

Source: https://www.twingate.com/docs/pulumi-azure

Defines a bash script that writes 'Hello, World!' to index.html and starts a simple HTTP server on port 80. This script is used as custom data for the VM.

```Bash
const initScript = pulumi.interpolate`#!/bin/bash\n
echo "Hello, World!" > index.html
nohup python -m SimpleHTTPServer 80 &`;
```

--------------------------------

### Install Twingate Linux Client via RPM (older dnf config-manager syntax)

Source: https://www.twingate.com/docs/linux

Alternative RPM installation commands for older versions of dnf. Adds the Twingate repository and installs the twingate package (or twingate-latest). After installation, run sudo twingate setup to configure the client.

```shell
dnf install -y 'dnf-command(config-manager)'
dnf config-manager --add-repo https://packages.twingate.com/rpm/
dnf config-manager --save --setopt=packages.twingate.com_rpm_.gpgcheck=0
dnf install -y twingate  # or twingate-latest
# After installation, configure the client by running: sudo twingate setup
```

--------------------------------

### Install Twingate Linux Client via RPM (dnf config-manager)

Source: https://www.twingate.com/docs/linux

Adds the Twingate RPM repository using dnf config-manager and installs the twingate package (or twingate-latest). After installation, run sudo twingate setup to configure the client.

```shell
dnf install -y 'dnf-command(config-manager)'
dnf config-manager addrepo --set=baseurl="https://packages.twingate.com/rpm/"
dnf config-manager setopt "packages.twingate.com_rpm_.gpgcheck=0"
dnf install -y twingate  # or twingate-latest
# After installation, configure the client by running: sudo twingate setup
```

--------------------------------

### Install Twingate Linux Client via Pacman (Arch Linux)

Source: https://www.twingate.com/docs/linux

Downloads and installs the Twingate package for Arch Linux. Includes commented commands for twingate-latest and aarch64 variants. After installation, run sudo twingate setup to configure the client.

```shell
curl https://binaries.twingate.com/client/linux/ARCH/x86_64/stable/twingate-amd64.pkg.tar.zst --output twingate.pkg.tar.zst
# for twingate-latest: curl https://binaries.twingate.com/client/linux/ARCH/x86_64/latest/twingate-amd64.pkg.tar.zst --output twingate.pkg.tar.zst
# for aarch64: curl https://binaries.twingate.com/client/linux/ARCH/aarch64/stable/twingate-amd64.pkg.tar.zst --output twingate.pkg.tar.zst
pacman -Syy
pacman -U --noconfirm twingate.pkg.tar.zst
# After installation, configure the client by running: sudo twingate setup
```

--------------------------------

### High-availability setup

Source: https://www.twingate.com/docs/diy-vpn-setup-guide

Example cluster configuration for high availability with a fixed 3-node cluster.

```hcl
"ha-cluster" = {
  region     = "fra1"
  node_size  = "s-4vcpu-8gb"
  node_count = 3      # Fixed 3-node cluster
}
```

--------------------------------

### PostgreSQL connection example and query output

Source: https://www.twingate.com/docs/database-access-gcp

Example of connecting to a PostgreSQL database and running a query. Shows the expected output including connection details and query results.

```bash
psql -h 10.82.0.3 -U postgres -d postgres
Password for user postgres:
psql (17.6, server 17.5)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

postgres=> SELECT * FROM sample_table;
 id |  name   | age |    city
----+---------+-----+-------------
  1 | Alice   |  30 | New York
  2 | Bob     |  25 | Los Angeles
  3 | Charlie |  35 | Chicago
  4 | David   |  28 | Houston
  5 | Eve     |  32 | Phoenix
(5 rows)

postgres=>
```

--------------------------------

### Create Webserver VM with Nginx

Source: https://www.twingate.com/docs/terraform-gcp

Creates a VM instance 'twingate-demo-webserver' with Ubuntu 22.04, installs Nginx, and sets a custom homepage.

```text
resource "google_compute_instance" "vm_instance_webserver" {
  name         = "twingate-demo-webserver"
  machine_type = "e2-micro"

  boot_disk {
    initialize_params {
      image = "projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts"
    }
  }

  network_interface {

    network = google_compute_network.demo_vpc_network.id
    subnetwork = google_compute_subnetwork.demo_subnet.id
    access_config {
    }
  }

  metadata_startup_script = <<EOF

    #!/bin/bash

    apt-get -y update
    apt-get -y install nginx

    echo "
    <style>
    h1 {text-align: center;}

    </style>

    <h1>TERRAFORM &#128153; TWINGATE </h1>

    " > /var/www/html/index.html

    service nginx start

    sudo rm -f index.nginx-debian.html

    EOF

}
```

--------------------------------

### CircleCI configuration for Twingate headless client (config.yaml)

Source: https://www.twingate.com/docs/example-cicd-configurations

This CircleCI configuration defines a job that installs, sets up, and starts the Twingate headless client on an Ubuntu machine image, tests access to a protected and a public resource, and stops the client. The $SERVICE_KEY is base64 encoded and must be decoded before passing to `twingate setup`. The base OS is Ubuntu; other distributions may not be compatible with the Linux Client.

```yaml
version: 2.1

jobs:
  headless_client:
    machine:
      image: ubuntu:jammy-20250530
    steps:
      - run:
          name: Start Twingate
          command: |
            # install
            sudo apt update -yq
            sudo apt install -yq ca-certificates
            echo "deb [trusted=yes] https://packages.twingate.com/apt/ /" | sudo tee /etc/apt/sources.list.d/twingate.list
            sudo apt update -yq
            sudo apt install -yq twingate
            # setup and start
            echo "$SERVICE_KEY" | base64 --decode | sudo twingate setup --headless=-
            sudo twingate start
            # collect logs
            sudo journalctl -u twingate --no-pager | tail -n 20
      - run:
          name: Test Access
          command: |
            # test protected resource
            curl -v -m 10 "$TEST_URL" > /dev/null
            # test public resource
            curl -v -m 10 http://twingate.com > /dev/null
      - run:
          name: Stop Twingate
          command: |
            # stop
            sudo twingate stop
            # test public resource after stop
            curl -v -m 10 http://twingate.com > /dev/null
workflows:
  test:
    jobs:
      - headless_client

```

--------------------------------

### Example connector.conf configuration

Source: https://www.twingate.com/docs/connectors-on-linux

Example contents of /etc/twingate/connector.conf. The three environment variables must be set with valid values for the Connector to run.

```text
TWINGATE_NETWORK=https://autoco.twingate.com
TWINGATE_ACCESS_TOKEN=a948904f2f0f479b8f8197694b...
TWINGATE_REFRESH_TOKEN=b64064fece69a4edc7ff87f86f...
```

--------------------------------

### Install and configure Twingate Client in headless mode

Source: https://www.twingate.com/docs/kubernetes-agent-access

Run these commands on each agent host to install and configure the Twingate Client in headless mode using the host's Service Key. The commands start the client and check its status.

```shell
sudo twingate setup --headless /path/to/service_key.json
sudo twingate start
twingate status
```

--------------------------------

### Initialize Terraform with terraform init

Source: https://www.twingate.com/docs/terraform-aws

Run terraform init to download and install the configured providers locally. The output shows the provider plugins being initialized and installed successfully, including versions and the creation of the lock file.

```shell
terraform init
```

```text
Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/aws versions matching "~> 4.0"...
- Finding latest version of twingate/twingate...
- Installing hashicorp/aws v4.29.0...
- Installed hashicorp/aws v4.29.0 (signed by HashiCorp)
- Installing twingate/twingate v0.2.0...
- Installed twingate/twingate v0.2.0 (self-signed, key ID E8EBBE80BA0C9369)

Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!
```

--------------------------------

### Install Prerequisites on Ubuntu/Debian

Source: https://www.twingate.com/docs/diy-vpn-setup-guide

Installs Minikube, kubectl, and Helm on Ubuntu/Debian using curl and shell scripts.

```bash
# Install Minikube
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube

# Install kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

# Install Helm
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
```

--------------------------------

### Start Minikube with Docker Driver

Source: https://www.twingate.com/docs/diy-vpn-setup-guide

Starts a Minikube cluster with 2 CPUs and 4GB memory using the Docker driver.

```bash
minikube start --cpus=2 --memory=4096 --driver=docker
```

--------------------------------

### HTTP Proxy Only (No Root Required) - twingated --http-proxy

Source: https://www.twingate.com/docs/linux-userspace-networking

Starts the client in userspace mode and listens for proxy connections on port 9999. Requires either interactive setup via `twingate setup` or headless mode with a service key at `/etc/twingate/service_key.json`.

```bash
twingated --http-proxy 0.0.0.0:9999 --tun off
```

--------------------------------

### Deploy Using Automated Script

Source: https://www.twingate.com/docs/diy-vpn-setup-guide

Runs the deploy.sh script to deploy the DIY VPN setup.

```bash
./deploy.sh
```

--------------------------------

### Get Current Status API Response

Source: https://www.twingate.com/docs/maintenance-events-service-status-outages

Example JSON response from the status endpoint, showing an 'all systems operational' status with no scheduled maintenance.

```json
{
  "page": {
    "id": "d3m2m1y4ghc6",
    "name": "Twingate",
    "url": "https://status.twingate.com",
    "time_zone": "Etc/UTC",
    "updated_at": "2022-06-28T02:24:29.048Z"
  },
  "scheduled_maintenances": [],
  "status": {
    "indicator": "none",
    "description": "All Systems Operational"
  }
}
```

--------------------------------

### Install next-auth@beta and jose

Source: https://www.twingate.com/docs/web-app-nextjs-authjs

Installs Auth.js v5 (next-auth@beta) and jose. Required for the integration.

```bash
npm install next-auth@beta jose
```
Tokens:
Raw