Gately v0.5.9 released

October 26, 2026

This release hosts File Browser (#23), issues IP address certificates (#24) and lets every managed external program be installed and rolled back online.

Download v0.5.9 · GitHub Release

File Browser

The File Services group gets a File Browser page that hosts the web file manager FileBrowser Quantum. The original filebrowser/filebrowser was archived in 2026 and no longer gets security fixes, so Gately uses the maintained Quantum fork.

• Each instance has a listen address and port, a base path for reverse proxying by path, one or more shared directories (each can be read-only), the interface language and the session lifetime;
• Sign-in is by username and password, by a username header from a reverse proxy (works with the Web Service's web authentication), or none (with a clear warning);
• The admin password is passed to File Browser through an environment variable and synced on every start, and is never written to a file;
• An instance whose shared directory is missing does not start, and deleting an instance deletes its data directory (users, share links, caches) while the files in the shared directories stay untouched.

See File services.

IP address and short-lived certificates

ACME certificates get a certificate profile: the CA default, the Let's Encrypt short-lived profile (about 6 days) or any other profile name the CA supports.

• Public IPv4 and IPv6 addresses can be entered in the domain list to get an IP address certificate. IP certificates need HTTP-01 validation and, with Let's Encrypt, the short-lived profile; the editor points this out and sets it up in one click;
• Preset CAs only issue for public addresses, so private, loopback and 100.64.0.0/10 addresses are refused; a custom CA (such as step-ca) has none of these limits but still needs HTTP-01;
• TLS connections without SNI (access by IP) get the IP certificate matching the local address;
• Short-lived certificates renew the set number of hours before expiry (24 by default, at most 80) and retry hourly after a failure; certificate cards show a Short-lived tag and the hours left.

See SSL certificates.

Online install for managed programs

The frp, cloudflared, Tailscale and File Browser pages get an Online install card:

• Install the latest stable release or a given version (also to downgrade). The download is checked against its SHA-256 and test-run on this machine before it replaces anything, and the processes using the program restart;
• Each program can have its own download proxy (http, https, socks5); empty uses the global update proxy;
• Replaced versions are kept in bin/.versions/ under the config directory, at most 3, and can be rolled back to or deleted in one click;
• Uninstall deletes the installed program and all previous versions and keeps the module settings;
• Restore default settings in the page header stops the processes and resets the module settings, with the old settings kept in the config history;
• Online install for Tailscale is Linux only, since there are no official static packages for macOS and Windows.

Programs are now looked up in the path set on the page, then bin/ under the config directory, then PATH, so online-installed programs take effect. See Networking and tunnels.

File service shared users

The WebDAV, FTP and SMB shared users are now edited on their own File Services → File shared users page, which shows for each service whether it is enabled and allows shared users, and which shared users a local user of the same name shadows. The service pages keep only the switch that allows shared users to sign in. The new GET/PUT /api/fileusers endpoint comes with the fileusers:read and fileusers:write token permissions, and the old /api/<service>/shared-users endpoints keep working.

Upgrade notes

• How to upgrade: the Linux binary upgrades from the About page; with Docker, pull the new image and recreate the container; on fnOS, install the new .fpk in the App Center; on OpenWrt, install the new .ipk / .apk.
• The config format is backward compatible and existing certificates are not reissued by the upgrade.
• With the new lookup order, a program of the same name in bin/ under the config directory is used before the one in PATH.
• File services turned off under Feature modules no longer block changes to the shared users.