Gately v0.5.0 released

October 19, 2026

Gately sits at the edge of your network and holds DNS credentials and certificate private keys, so being able to see what it does has always been the first principle. v0.5.0 extends that from open source code to a traceable runtime: who changed what and when, how the configuration evolved, and whether the binary you downloaded really came from the official build.

Download v0.5.0 · GitHub Release

Traceability: audit log and config history

• Audit log: sign-ins, every configuration change, backup or private-key downloads and terminal sessions are recorded with the user, source IP, method and path. Request bodies and secrets are never stored.
• Config history with one-click rollback: the previous version is saved every time a config file is overwritten (30 kept per file). Compare line by line and roll back; the rollback itself can be undone.
• Real client address: when the admin UI sits behind nginx, haproxy or Gately Web Services on the same host, forwarded addresses are trusted only from local proxies, so LAN-only access, sign-in rate limiting and the audit log all see the real visitor.

See Audit Log & Config History.

Safer sign-in

• Passkey sign-in: use your fingerprint, face or device PIN instead of a password. Only the public key is stored, and no authenticator code is needed.
• Read-only accounts: give family or colleagues a view-only account that cannot change settings, download backups or read secrets.
• Signed releases: binaries and Docker images ship with cosign signatures, build provenance and an SBOM, so you can confirm they came from the official CI. See Verifying release artifacts.

New features

• ACME HTTP-01: issue certificates even without a supported DNS provider.
• HTTP/3 (QUIC) for Web Services listeners, enabled with one switch.
• PROXY protocol from port forwarding: keep the real client address across haproxy and nginx hops. See Port Forwarding.
• Seven new DDNS providers: Amazon Route 53, OVHcloud, Gandi, NS1, Bunny DNS, Namecheap and DynDNS2 (No-IP, Dynu, …).
• Seven new notification channels: ntfy, Gotify, Pushover, Discord, Slack, ServerChan and PushPlus, plus built-in rule templates such as "Critical failures", "Certificate expiry" and "Security & sign-ins".

Easier operations

• Global Prometheus endpoint /api/metrics: certificate expiry, DDNS sync status, port-forwarding traffic, and site and upstream health in one scrape, with a Grafana dashboard. See Monitoring.
• Network self-check: public IPv4 / IPv6, carrier-grade NAT, clock, ports 80 / 443, DDNS resolution and certificate expiry in one click.
• First-run onboarding: change the password, set up two-factor or a Passkey, run the self-check, import from Lucky and configure notifications on one page.
• Deployment: GATELY_INITIAL_PASSWORD sets the initial password, the -apply declarative config directory suits GitOps, and systemd and OpenWrt service templates are included. See Installation.

Upgrade notes

• Docker: pull the new image and recreate the container. Binary: replace the executable and restart.
• When a port-forwarding rule sends PROXY protocol, the target (for example haproxy accept-proxy) must accept it. Before downgrading to v0.4.x, remove the PROXY setting on the target first.
• Trusting local proxies is on by default and can be turned off under Settings → Access Control.
• With QUIC support the single binary is now about 32 MB.

Questions and ideas are welcome on GitHub Issues or in the Telegram group.