Gately v0.5.5 released

October 21, 2026

This release is about moving over from nginx and having less to look after once you have: existing nginx sites can be imported directly, renewed certificates are delivered to other hosts and containers automatically, cloud drive and WebDAV sites can sit behind the WAF, IP access control can reference province and city IP lists that update on schedule, and the network self-check spots sites without certificates and frp conflicts ahead of time.

Download v0.5.5 · GitHub Release

Import nginx config

The Web Services page has a new "Import nginx" button. Run nginx -T on the nginx host and paste the full output; included files are expanded the way nginx does.

• Preview before importing: sites are listed by listen port with their type, backend or directory, source file and line, plus anything that needs attention, such as variables, regex locations or missing certificates;
• Converts reverse proxies (including upstream weights, backups and balancing policies), static directories, redirects, fixed responses, response and request headers, compression, allow / deny, and location-level per-path backends, access control and redirects;
• auth_request becomes forward auth, and common Authelia setups (set variables, error_page 401 login redirects) convert directly; when it is enabled only in some locations, it becomes authentication for the specified paths only. auth_basic becomes basic auth with shared users, so no site is left unprotected after the import;
• Sites on the same port join the existing listener and existing domains are skipped, so you can import again; sites are imported disabled by default, so you can run them alongside nginx and check them one by one.

The feature was validated against a real production config (77 sites, Authelia, upstreams), and the result matches a manual migration. See Web Services · Import nginx config.

Certificate auto deploy

The certificate editor has a new "Auto deploy" section that runs after a certificate is issued, renewed or updated:

• Upload to SSH host: pick an existing SSH connection from Web Terminal; the certificate is written to a remote directory and then a command runs, for example systemctl reload nginx. The command can use $certName, $certDir, $certFile and $keyFile. Files are written to temporary files first and then swapped in, and the private key gets permission 0600;
• Restart local containers: after the certificate changes, the selected Docker containers are restarted in turn.

Auto deploy never trusts an unknown host, so connect to the SSH connection once in Web Terminal first. Failures are retried every hour and raise the new "Certificate: deployment failed" notification; "Deploy now" on the certificate card runs it right away and shows the result for each target. See SSL Certificates.

WAF: large uploads and WebDAV

• The request body inspection limit is adjustable (12.5 MB by default, up to 1024 MB); over the limit you can reject the request or inspect only the first part and pass the rest through unchanged;
• Paths without body inspection: request bodies to upload endpoints are skipped, while headers, URL and query parameters are still inspected;
• WebDAV and upload compatible: allows PUT, PROPFIND, MKCOL, MOVE, COPY, LOCK and similar methods and the Lock-Token, If and Content-Range headers, and no longer restricts upload content types, so cloud drives, WebDAV and file managers work behind the WAF while injection, path traversal and other attacks are still blocked;
• All instances now allow the Expect: 100-continue header that curl and rclone send with large uploads; OWASP CRS 4 used to block these uploads.

See WAF Firewall.

Subscribed IP lists

Under "Web Services → Global settings" you can subscribe to IP lists by URL and refresh them on schedule, for example the province and city ranges from metowolf/iplist. Allowlists and blocklists of sites and path rules can reference several lists, checked together with manually entered ranges. Downloads are cached locally, so no network access is needed after a restart, and content that cannot be parsed keeps the previous list. See Web Services · Subscribed IP lists.

Two new network self-check items

• HTTPS site certificates: lists domains without a matching certificate; requests to them fail during the TLS handshake;
• frp conflicts: lists duplicate proxy names in frpc, plus proxy name, domain or remote port conflicts reported by frps. When several devices share a copy of the same frpc config, the device that connects later fails to register and its sites time out.

Other improvements

• Online upgrade supports four-part version numbers such as v0.5.4.1; when versions cannot be compared (for example a development build), the dialog says so clearly and no longer claims "You are on the latest version".
• Messages returned by endpoints such as certificate deployment and the nginx import preview follow the UI language.

Upgrading

• From v0.5.4 on, Linux binary installs can upgrade to v0.5.5 right from the About page; with Docker, pull the new image and recreate the container; on fnOS, install the new .fpk from the App Center; on OpenWrt, install the new .ipk / .apk.
• For cloud drive and WebDAV sites already behind the WAF, turn on "WebDAV and upload compatible" in their WAF instance after upgrading and uploads will work.

Questions or suggestions are welcome in GitHub Issues or the Telegram group.