Gately v0.6.0 released

October 27, 2026

This release runs several frp instances, and the Web Service gains per-user routing (#29), site groups and sorting (#28) and sign-in cookie forwarding (#30). It also fixes certificates for subdomains hosted at another DNS provider (#27).

Download v0.6.0 · GitHub Release

Several frp instances

• Run several frpc instances (each connected to one frps) and several frps instances (each on its own ports). Every instance is its own process with its own config file and log source, and can be enabled, restarted, edited and deleted on its own;
• proxies belong to an frpc instance and the list can be filtered by instance; changing a proxy restarts only the instances whose config changed; deleting an frpc instance deletes its proxies;
• program paths move to a separate Programs card;
• ini / toml imports can target an existing or a new instance, and the Lucky import brings in every frpc / frps instance;
• the old single frpc / frps settings are migrated on upgrade to instances named frpc / frps, keeping the token and proxies.

See Networking & Tunnels.

Web Service

• Route by signed-in user: reverse proxy sites with basic, web or forward authentication can send listed users to their own backends, like nginx map $remote_user $backend. Users can be site users, shared users, provider:id from third-party sign-in, or the Remote-User returned by forward auth; users not listed and visitors not signed in on public paths use the site backends. A header such as X-Remote-User can pass the user name to the backend, and the same header sent by visitors (including spellings with underscores instead of hyphens) is always removed.
• Site groups, sorting and search: sites can have a group and are shown in collapsible groups under each listener; Sort mode moves sites up and down or by dragging, moves whole groups and reorders listeners; the search box filters by domain, name, group, backend and remark. Order only affects the list, not domain matching.
• Forward Gately sign-in cookies: a new reverse proxy option that passes the single sign-on and site session cookies to the backend unchanged, so a public Gately can run only the WAF and access control in front of a LAN Gately that handles web authentication and single sign-on. It cannot be combined with authentication on the same site.

See Web Service.

Certificates

When the zone is left empty, DNS-01 validation first looks up the authoritative zone of the validation record with an SOA query, so subdomains hosted at another DNS provider (web.example.com apart from example.com) and multi-level suffixes are detected correctly. If the lookup fails, or returns a zone shorter than the registrable domain (for example when a local DNS overrides a parent domain), the zone is inferred from the domain name and the reason is logged. The DNS servers set on a certificate now apply to that certificate only.

Show saved passwords

Masked passwords, tokens and keys get an eye button that fetches the plain text from the new .../secrets endpoints:

• write permission is required: read-only accounts and read-only API tokens get 403, and every lookup is recorded in the audit log;
• web terminal connection and preset passwords need the terminal's two-factor check first, just like opening a terminal;
• bcrypt-hashed web user passwords, OIDC client secrets and private keys are never returned;
• shared users with two-factor sign-in can show their QR code again;
• the default read-only mode of gately mcp does not offer these endpoints; they are available with --write.

Upgrade notes

• How to upgrade: the Linux binary upgrades from the About page; with Docker, pull the new image and recreate the container; on fnOS, install the new .fpk in the App Center; on OpenWrt, install the new .ipk / .apk.
• The config format is backward compatible. Old frp settings are migrated to instances on first start, and the frp/frpc.toml and frp/frps.toml files written by older versions are removed.
• The /api/frp/client and /api/frp/server endpoints are removed in favor of /api/frp/clients, /api/frp/servers and /api/frp/settings; scripts calling the old endpoints need to be updated.
• The mask for Docker registry passwords is now 8 asterisks like other modules; the old 6-asterisk mask is still accepted.