Gately v0.5.8 released

October 25, 2026

This release lets Gately act as an OIDC identity provider, adds SMB file sharing (#15), adds filtering to every log (#16), and lets you reorder WAF rule groups (#17).

Download v0.5.8 · GitHub Release · OIDC single sign-on docs

OIDC single sign-on

The Web Service has a built-in OpenID Connect identity provider. Gitea, OpenList, Grafana and other applications that support OIDC sign-in can sign users in with the shared users and tell who signed in, replacing Authelia's OIDC feature.

• Enter the issuer URL and add clients in "Web Service → Global settings → OIDC identity provider"; the issuer domain needs no site;
• Shared users gain optional email, display name and groups, provided to applications as the email, name and groups claims, so applications can create accounts automatically and grant admin rights by group;
• Each client can be limited to certain users or groups; PKCE, refresh tokens and prompt=none / prompt=login are supported, and public clients (single-page apps, mobile apps) must use PKCE;
• Sign-in reuses the web authentication login page and TOTP two-step verification; when the issuer is inside the SSO domain, signing in to any site is enough to get into the applications as well;
• Changing the password or TOTP, deleting the user or removing them from the allowed list revokes tokens already issued at once; sub is the shared user's fixed ID and stays the same after a rename;
• The docs include setup examples for Gitea, OpenList and Grafana, each checked against the real application.

SMB Service

File Services gains SMB Service, which shares local directories with Windows Explorer, the macOS Finder, Linux and SMB clients on phones and TVs:

• SMB 2.0.2 to 3.1.1, NTLMv2 authentication and signing, with optional mandatory SMB 3 encryption;
• Users are configured the same way as for FTP and WebDAV; each user only sees their own shares, and each directory can be made read-only;
• The page lists the connection address of every share, and Bonjour advertising lets the Finder discover the service directly;
• Available on Linux and macOS only. Windows only connects to port 445, so when the Samba that ships with a NAS already uses it, choose another port.

Log filtering

System Logs and the log card of every module can be filtered by level, source, keyword (with phrases and excluded words), client IP or range, and time range; the Web Service can also filter by site, domain and status code. Filtering runs on the server, and Load earlier logs keeps searching the log files on disk. Web Service access logs and WAF hit logs record the client IP, domain, status code and rule ID; click a tag in a log entry to filter by that value. The log API accepts the same filter parameters.

Web Service and WAF

• Site request and response headers are edited row by row, with names and values picked from common entries (HSTS, CSP, X-Frame-Options and more); one click adds the common security headers, and the format and common mistakes are checked as you type; the Content-Type of fixed text sites can be picked from common types;
• Request headers whose name or value contains illegal characters are rejected on save; before, such a configuration made the whole site return 502;
• A new explanation next to the reverse proxy Options describes what each of the six options does and when to use it;
• WAF rule groups can be moved up and down. Allow rules (allow, ctl: and the like) go above OWASP CRS, and removal directives such as SecRuleRemoveById go below CRS; both the interface and the docs explain this.

Fixes

• Renaming an FTP or WebDAV user without retyping the password failed to save.

Upgrade notes

• How to upgrade: Linux binaries upgrade from the About page; Docker pulls the new image and recreates the container; fnOS installs the new .fpk from the App Center; OpenWrt installs the new .ipk / .apk.
• The configuration format is backward compatible, so you can upgrade directly. Shared users get a fixed ID on first start, which is written back to the configuration file.
• The web authentication login form rejects submissions from other websites; normal sign-in is unaffected.