Gately v0.5.9.1 released

October 26, 2026

This update of the v0.5.9 series comes from the suggestion in issue #25 and fixes two editors that could not save.

Download v0.5.9.1 · GitHub Release

HTTP and HTTPS on the same port

Listeners with HTTPS enabled get a Plain HTTP on same port option, set to Reject by default. With Redirect to HTTPS, http://host:port redirects to https://host:port (301 for GET and HEAD, 308 for other methods so the method and body are kept); with Serve, sites are answered over plain HTTP. This helps when only one port can be mapped and visitors may type the wrong scheme, such as a non-standard port on a home connection.

Gately tells TLS and HTTP apart by the first byte of each connection. PROXY protocol headers are still read before that, HTTP/2 negotiation and ACME HTTP-01 challenges keep working, and Alt-Svc is only sent over HTTPS. When importing nginx configs, error_page 497 https://$host:$server_port$request_uri in an HTTPS server becomes Redirect to HTTPS. See Web Service.

File Browser access URLs

A File Browser instance can list several access URLs, such as https://files.example.com/ reverse proxied by the Web Service. The instance card shows them, and when the list is empty the address is still guessed from the listen address and port. The scheme, host and port of the first URL become File Browser's external URL, which share links use. See File services.

Fixes

• Saving an edited File Browser instance failed with json: unknown field "state". Fixed.
• Saving an edited Cloudflare tunnel failed with the same json: unknown field "state" error. Fixed.
• With shared users turned on, the FTP and WebDAV listen logs showed 0 users (issue #26). They now read "N users, M of them shared users" like SMB, and WebDAV logs the new counts when the shared users change.

Upgrade notes

• Plain HTTP on same port is off by default, so existing listeners behave as before. Changing it restarts the listener and drops its open connections.
• With Serve, sites reached over plain HTTP are not encrypted, and passwords for web auth and shared users are sent in clear text too. Use Redirect to HTTPS for access from the internet.