Gately v0.5.2 released

October 20, 2026

A public IP has one port 443, and VPNs, websites and proxies all want it. The usual answer is haproxy or nginx stream in front to route by domain and nginx behind it for reverse proxying: three programs, three configurations. v0.5.2 lets Gately do all of it in one program: routing by domain, reverse proxy and TOTP sign-in, at a speed that keeps up with haproxy + nginx.

Download v0.5.2 · GitHub Release

SNI routing: several services on port 443

Port forwarding has a new "SNI routing" mode (requested by a user in the Telegram group, #3):

• It reads the domain from the TLS handshake and passes the whole connection through to the backend chosen by domain. TLS is not decrypted here, so certificates stay on the backends;
• Domains can be exact, a *.example.com wildcard or *. Connections with no match, no SNI or not TLS go to the default target, and are closed when there is none;
• PROXY protocol v1 / v2 is set per route, so backends get the real client address;
• The rule card shows how many connections each route and the default target received.

See Port Forwarding for a complete example of replacing haproxy.

Web Services can replace nginx

• Path backends: send a path prefix to another set of backends, or add request headers for that path only, like an nginx location;
• Forward auth: hand authentication to Authelia or a similar service, like auth_request, and protect only paths such as /admin;
• HTTPS backends receive the visited domain as SNI: needed when the backend routes by SNI, for example frp's vhost_https;
• {host} in redirects: one rule with https://{host} sends HTTP to HTTPS for every domain;
• Static sites: clean URLs (VitePress and similar), a custom 404 page and response headers;
• Editing a site no longer restarts the listener: open connections (WebSocket included) stay up, statistics are kept, and an invalid new configuration leaves the old one serving.

See "Replacing haproxy and nginx" in Web Services for how nginx settings map over.

Shared users: TOTP and single sign-on

Add shared users under "Web Services → Global settings", turn on TOTP for each one (scan a QR code), and set a single sign-on domain such as example.com so that signing in on one site covers every site under it. A site only needs "Use shared users" ticked. If you would rather not run Authelia just for this, it is built in.

Performance

haproxy + nginx and Gately compared on one machine, each limited to 2 CPU cores, with the configuration of a real server (90 domains, PROXY protocol v2):

Scenario	haproxy + nginx	Gately
HTTPS reverse proxy, keep-alive, 1 KB responses	14,767 req/s	26,434 req/s
A new TLS connection for every request	2,557 req/s	3,448 req/s
1 MB responses	1,053 MB/s	1,585 MB/s
SNI passthrough of a TLS stream	2,927 MB/s	4,962 MB/s
SNI passthrough, new connections per second	6,334 /s	6,266 /s

For memory, Gately uses about 110 MB and haproxy plus nginx about 42 MB together. The method, full numbers and caveats are in the README.

Upgrade notes

• Docker: pull the new image and recreate the container. Binary: replace the executable and restart.
• Versions before v0.5.2 do not understand SNI routing rules. Disable or delete them before downgrading: an older version treats them as plain forwarding, and a rule without a default target crashes it on the first connection.
• When taking over from haproxy, stop haproxy before enabling the Gately rule, because only one program can listen on a port.

Questions and ideas are welcome on GitHub Issues or in the Telegram group.