Gately v0.6.0.3 released

October 28, 2026

This is a bug-fix update in the v0.6.0 series with no new features. Users running a "public Gately → tunnel → LAN Gately" chain should upgrade.

Download v0.6.0.3 · GitHub Release

HTTPS forwarded through trusted PROXY sources

When a public Gately terminated TLS and forwarded plain HTTP with a PROXY v2 header to a LAN Gately through an frp tcp tunnel, the LAN Gately saw the visitor's public address and only trusted X-Forwarded-Proto: https from the local host and private networks, so it treated these requests as plain HTTP: the OIDC identity provider with an https issuer redirected or rejected sign-in, authorization and token requests, and session cookies for web authentication, shared users, single sign-on and share links lacked Secure.

X-Forwarded-Proto: https on connections from a "Trusted PROXY source" is now honored as well, and is used consistently for:

• the OIDC issuer's HTTPS check and the Secure flag on all session cookies;
• the third-party sign-in return address and the scheme passed to forward auth services;
• ports that redirect plain HTTP to HTTPS no longer redirect these requests, avoiding a redirect loop;
• reverse proxy sites with "Add X-Forwarded-*" on now send X-Forwarded-Proto: https to the backend, so backend apps build correct https links.

See the OIDC identity provider and Web Service docs for the setup: turn on "Add X-Forwarded-*" and "Send PROXY v2 to the backend" on the public site, enable accepting the PROXY protocol on the LAN Gately's listener, and add the tunnel's local source address to its trusted PROXY sources. The header is still ignored from untrusted sources and public visitors.

Port in use when restarting a listener

When a Web Service listener, the WebDAV service or the temporary HTTP-01 listener was stopped or restarted right after starting, the old port could still be held and listening again occasionally failed with "address already in use" (for example when saving listener settings twice in a row). The listener is now closed synchronously when stopping, so a restart works immediately.

Upgrading

• Docker: pull the new image and recreate the container. OpenWrt: install the new .apk / .ipk over the old one. fnOS: install the new .fpk in the App Center. Other installs can upgrade online in Settings.